Android Security & Malware

Exploiting embedded mitel phones for unauthenticated remote code execution
Achieving a fully unauthenticated RCE exploit as root in a Mitel IP phone. Several 0-days were discovered which chained together gives the privilege of completely owning the phone
https://baldur.dk/blog/embedded-mitel-exploitation.html

👍19❤2👏2

10.6K views08:20

👍 24 👎 1

Exfiltrate WhatsApp chat, or internal data of any Android app, running on Android 12 or 13 by exploiting CVE-2024-0044 vulnerability [video]
https://www.mobile-hacker.com/2024/06/17/exfiltrate-sensitive-user-data-from-apps-on-android-12-and-13-using-cve-2024-0044-vulnerability/

Mobile Hacker

Exfiltrate sensitive user data from apps on Android 12 and 13 using CVE-2024-0044 vulnerability Mobile Hacker

With physical access to Android device with enabled ADB debugging running Android 12 or 13 before receiving March 2024 security patch, it is possible to access internal data of any user installed app by misusing CVE-2024-0044 vulnerability. Internal data…

👍38❤2👏2

11.2K views12:39

👍 50 👎 1

Android Security & Malware

NetHunter Hacker XVI: Metasploit payload generator in a pocket
https://www.mobile-hacker.com/2024/06/20/nethunter-hacker-xvi-metasploit-payload-generator-in-your-pocket/

Mobile Hacker

NetHunter Hacker XVI: Metasploit payload generator in your pocket

We will explore features of using Metasploit payload generator on NetHunter, and show you how to create and deliver custom payloads to Android smartphone

👍30💯5

9.98K views12:45

👍 43 👎 1

Android Security & Malware

Mobile OAuth Attacks - iOS URL Scheme Hijacking Revamped
30 popular apps, vulnerable to attack in which any installed iOS app from the Apple App Store could perform an account takeover of victim users
https://evanconnelly.github.io/post/ios-oauth/

Evan Connelly

Mobile OAuth Attacks - iOS URL Scheme Hijacking Revamped

Summary
We (Julien Ahrens @MrTuxracer and myself @Evan_Connelly) identified nearly 30 popular apps, as well as a feature within iOS itself, vulnerable to an attack in which any installed iOS app from the Apple App Store could perform an account takeover of…

👍15

9.1K views04:58

👍 20 👎 1

Android Security & Malware

Android Rafel RAT - from Espionage to Ransomware Operations campaigns - attributed to APT-C-35 / DoNot Team APT group
https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/

Check Point Blog

Rafel RAT, Android Malware from Espionage to Ransomware Operations - Check Point Blog

When it comes to mobile devices, Android is the most popular and used operating system with over 3.9 billion active users in over 190 countries.

👍19👾3👏1

8.15K views08:40

👍 13 👎 1

Android Security & Malware

Monitor file system changes using fsmon
▪️supports Linux, iOS, OS X, Android
▪️identify when are binaries loaded (root)
▪️get dropped payloads (root)
▪️identify when are which files opened at app's runtime (db, txt, log, temp...) (non-root)
https://www.mobile-hacker.com/2024/06/24/monitoring-android-file-system-with-fsmon/

Mobile Hacker

Monitoring Android file system with fsmon

FileSystem Monitor (fsmon) allows you to monitor file system events at runtime on Linux, OSX, iOS and Android systems. Useful for bug bounty hunters, malware analyst

👍20❤2

8.41K views12:32

👍 30 👎 3

Android Security & Malware

SpyMax – An Android RAT targets Telegram Users
https://labs.k7computing.com/index.php/spymax-an-android-rat-targets-telegram-users/

K7 Labs

SpyMax – An Android RAT targets Telegram Users

Threat actors are constantly working on novel ways to target users across the globe. This blog is about SpyMax, an […]

😱19👍1

8.53K views07:05

👍 31 👎 2

Android Security & Malware

Android Medusa (TangleBot) banking trojan reborn: A New Compact Variant Discovered
https://www.cleafy.com/cleafy-labs/medusa-reborn-a-new-compact-variant-discovered

Cleafy

Medusa Reborn: A New Compact Variant Discovered | Cleafy Labs

Discover the latest insights from the Cleafy Threat Intelligence team on new fraud campaigns involving the Medusa (TangleBot) banking trojan. Learn about Medusa's sophisticated capabilities, recent updates, and shifts in distribution strategies targeting…

👍16❤1

9.04K views11:13

👍 21 👎 5

Android Security & Malware

Clone and emulate RFID access card in a second using Proxmark3 in a standalone mode
https://www.mobile-hacker.com/2024/06/26/rfid-hacking-with-proxmark3-cloning-emulating-and-standalone-mode/

Mobile Hacker

RFID Hacking with Proxmark3: Cloning, Emulating, and Standalone Mode

Access cards – those little plastic rectangles that grant us entry to buildings, parking lots, and secure areas. But what if I told you that these cards can be cloned, and even emulated? Enter the Proxmark3, a powerful tool that opens doors (literally) to…

👍19❤6

11.2K views12:15

👍 34 👎 5

Android Security & Malware

Snowblind: A new Android malware abuses security feature to bypass security
Blog: https://promon.co/app-threat-reports/snowblind
Demo: https://youtu.be/zUqZQlQ0ZzQ?si=oZhSdfR1w_SlNjSA

promon.io

Snowblind Android Malware - Promon

👍21❤4🤓1

10.3K views14:38

👍 26 👎 2

Android Security & Malware

BADUnboxing: Automated Android unpacker
It works by locating and decompiling code inside the APK that is relevant to the unpacking process. Once Bad Unboxing detects packing, it automatically generates a new Java application based on the decompiled code
https://github.com/LaurieWired/BadUnboxing

GitHub

GitHub - LaurieWired/BadUnboxing: Automated Android custom unpacker generator

Automated Android custom unpacker generator. Contribute to LaurieWired/BadUnboxing development by creating an account on GitHub.

🔥21👏5👍3🥱2❤1🤡1

9.3K views04:51

👍 26 👎 1

Android Security & Malware

Transparent Tribe (aka APT 36, Operation C-Major) Android Spyware Targeting Gamers, Weapons Enthusiasts
https://www.sentinelone.com/labs/capratube-remix-transparent-tribes-android-spyware-targeting-gamers-weapons-enthusiasts/

SentinelOne

CapraTube Remix | Transparent Tribe’s Android Spyware Targeting Gamers, Weapons Enthusiasts

SentinelLABS has identified four new CapraRAT APKs associated with suspected Pakistan state-aligned actor Transparent Tribe.

👍18

8.21K views16:24

👍 20 👎

Android Security & Malware

BlueToolkit - automated Bluetooth vulnerability testing framework
✅Can test 43 exploits
✅Runs on rooted Android, which makes it a portable Bluetooth vulnerability scanner
✅It already helped to find 64 new vulnerabilities in 22 products
https://www.mobile-hacker.com/2024/07/02/uncover-bluetooth-vulnerabilities-with-bluetoolkit/

Mobile Hacker

Uncover Bluetooth Vulnerabilities with BlueToolkit

BlueToolkit is designed to uncover both new and old vulnerabilities in Bluetooth-enabled devices. This makes it a capable tool for vulnerability research, penetration testing, and Bluetooth hacking

👍32👏4

9.62K views08:47

👍 51 👎 1

Android Security & Malware

The many meanings of "system app" in modern Android
https://rtx.meta.security/reference/2024/07/03/Android-system-apps.html

Meta Red Team X

The many meanings of “system app” in modern Android

Not all Android apps are created equal. The Settings app on an Android device, for example, can change numerous things that no “normal” app can, regardless of how many permissions that app requests. Apps with special privileges like Settings are often called…

👍14❤1

8.88K views06:56

👍 18 👎 1

Android Security & Malware

Kali NetHunter 101: Your Path to Mobile Ethical Hacking
A list of 16 blogs on how to install and use NetHunter and its tools such as KeX, Rubber Ducky, BadUSB, BadBT, WiFi hacking, Rogue AP, WPS & Bluetooth attacks, SET, MITMf, nmap, Metasploit...
https://www.mobile-hacker.com/2024/07/04/kali-nethunter-101-your-path-to-mobile-ethical-hacking/

Mobile Hacker

Kali NetHunter 101: Your Path to Mobile Ethical Hacking

This is a recap of a complete NetHunter Hacker series where I covered various aspects of Kali NetHunter providing detailed insights, tutorials, and practical examples to help you harness its capabilities to its fullest potential. Quick video introduction…

🔥27👍8

12.2K views08:05

👍 36 👎 3

Android Security & Malware

Discovered Android Surveillanceware Targeting Middle Eastern Militaries
https://security.lookout.com/threat-intelligence/article/guardzoo-houthi-android-surveillanceware

Lookout

Lookout discovers Houthi surveillanceware targeting Middle Eastern Military | Threat Intel

In October 2022, Lookout researchers initially discovered a surveillanceware that is still being used to target military personnel from Middle Eastern countries

👍13