Android Security & Malware

France’s COVID-19 tracing app has been downloaded and activated 1.8M times on Android and iOS since launch on 2 June... but then uninstalled 460,000 times.
Src: https://twitter.com/gcluley/status/1275720504092102656

Twitter

Graham Cluley

France’s COVID-19 tracing app has been downloaded and activated 1.8m times on Android and iOS since launch on 2 June... but then uninstalled 460,000 times.

4.23K views09:35

👍 9 👎💬

Android Security & Malware

The #RoamingMantis group targets Android and iOS devices (phishing Apple ID) in Europe #FakeCop
https://medium.com/csis-techblog/the-roamingmantis-groups-expansion-to-european-apple-accounts-and-android-devices-e6381723c681

Medium

The RoamingMantis Group’s Expansion to European Apple Accounts and Android Devices

Background

4.36K views11:45

👍 8 👎 1 💬

Android Security & Malware

iOS/MacOS wifi proximity kernel double free in AWDL BSS Steering
https://bugs.chromium.org/p/project-zero/issues/detail?id=2012

4.51K views21:00

👍 7 👎 2 💬

Android Security & Malware

TikTok Secretly Spying On Clipboard of Millions iPhone Users
https://www.forbes.com/sites/zakdoffman/2020/06/26/warning-apple-suddenly-catches-tiktok-secretly-spying-on-millions-of-iphone-users/amp/

Forbes

Warning—Apple Suddenly Catches TikTok Secretly Spying On Millions Of iPhone Users

If you are a TikTok user, you should be worried—here's what you need to know.

4.6K views16:12

👍 27 👎 3 💬

Android Security & Malware

Android malware detection based on image-based features and machine learning techniques
https://link.springer.com/article/10.1007/s42452-020-3132-2

SpringerLink

Android malware detection based on image-based features and machine learning techniques

SN Applied Sciences - In this paper, a malware classification model has been proposed for detecting malware samples in the Android environment. The proposed model is based on converting some files...

3.58K views11:20

👍 9 👎💬

Android Security & Malware

Debugging the Samsung Android Kernel
Part 1: https://blog.pucarasec.com/2020/06/09/debugging-the-samsung-android-kernel-part-1/
Part 2: https://blog.pucarasec.com/2020/06/16/debugging-the-samsung-android-kernel-part-2/
Part 3: https://blog.pucarasec.com/2020/06/23/debugging-the-samsung-android-kernel-part-3/

Posts by Pucara Information Security Team

Debugging the Samsung Android Kernel part 1:

Compiling a custom Samsung Android Kernel, and living to tell the tale. Many security enthusiasts and sysadmins are familiar with the process in which one custom compiles a Linux Kernel and th…

3.91K views11:32

👍 21 👎💬

Android Security & Malware

Forwarded from The Bug Bounty Hunter

Android App Source code Extraction and Bypassing Root and SSL Pinning checks

https://vj0shii.github.io/android-app-testing-initial-steps/

vj0shii.github.io

Android App Source code Extraction and Bypassing Root and SSL Pinning checks

In this blog I will be describing the pre-requesty steps I followed for one of the android application penetration testing

936 views21:54

Android Security & Malware

SafetyNet’s dreaded hardware attestation is rolling out, making it much harder for Magisk to hide root
https://www.xda-developers.com/safetynet-hardware-attestation-hide-root-magisk/

XDA

SafetyNet's dreaded hardware attestation is rolling out, making it much harder for Magisk to hide root

Hiding root access in Magisk is about to become a whole lot harder to do thanks to a recent change in SafetyNet bringing hardware attestation.

3.82K views09:43

👍 8 👎 1 💬

Android Security & Malware

Android 11

Privacy updates:
•Auto-reset permissions from unused apps!
•Package visibility: can't list installed apps!
•New, clearer permission to obtain user phone number!
•One-time permissions (temp granted permissions)
•Background location access
•Scoped Storage
https://developer.android.com/preview/privacy

Android Developers

Privacy in Android 11 | Platform | Android Developers

Read about the privacy changes in Android 11 and learn how to support them in your apps.

3.72K views16:36

👍 12 👎💬

Android Security & Malware

Intercept & view all Android HTTP(S)
Mock endpoints or entire servers
Rewrite, redirect, or inject errors
https://httptoolkit.tech/android

Httptoolkit

Intercept, mock & debug Android HTTP traffic

HTTP Toolkit includes built-in automatic setup and advanced support for Android, so you can debug and modify any HTTP(S) traffic in seconds.

3.66K views16:56

👍 9 👎💬

Android Security & Malware

Clipboard Toast
An Xposed module that notifies you whenever an app reads your clipboard
https://github.com/ubuntuegor/ClipboardToast

GitHub

GitHub - ubuntuegor/ClipboardToast: Clipboard access notification inspired by iOS 14

Clipboard access notification inspired by iOS 14. Contribute to ubuntuegor/ClipboardToast development by creating an account on GitHub.

3.88K views19:46

👍 24 👎💬

Android Security & Malware

Package visibility in Android 11 #ForDevelopers
https://medium.com/androiddevelopers/package-visibility-in-android-11-cc857f221cd9

Medium

Package visibility in Android 11

On Android 10 and earlier, apps could query the full list of installed apps on the system using methods like queryIntentActivities. In…

3.68K views07:36

👍 7 👎💬

Android Security & Malware

Android FakeSpy analysis | Roaming Mantis
https://www.cybereason.com/blog/fakespy-masquerades-as-postal-service-apps-around-the-world

Cybereason

FakeSpy Masquerades as Postal Service Apps Around the World

The Cybereason Nocturnus team is investigating a new campaign involving FakeSpy, an Android mobile malware used to steal SMS messages, send SMS messages, steal financial data, read account information and contact lists, steal application data, and do much…

4.03K views10:37

👍 5 👎💬

Android Security & Malware

Multiyear Surveillance Campaigns Discovered Targeting Uyghurs | mAPT | SilkBean| DoubleAgent CarbonSteal | GoldenEagle
https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf

3.7K views08:45

👍 11 👎 1 💬

Android Security & Malware

Popular Android malware threats - Jun, 2020
Full list: https://skptr.me/malware_timeline_2020.html
Download samples: https://github.com/sk3ptre/AndroidMalware_2020

GitHub

GitHub - sk3ptre/AndroidMalware_2020: Popular Android malware seen in 2020

3.49K views07:14

👍 11 👎 1 💬

Android Security & Malware

LinkedIn iOS app is copying the contents every clipboard keystroke. IOS 14 allows users to see each paste notification
https://www.zdnet.com/article/linkedin-says-ios-clipboard-snooping-after-every-key-press-is-a-bug-will-fix/

ZDNet

LinkedIn says iOS clipboard snooping after every key press is a bug, will fix

The new clipboard access detection and warning feature in iOS 14 exposes another app.

3.61K views10:45

👍 7 👎 1 💬

Android Security & Malware

Android Keylogger Injector demo
Be aware of such techniques when downloading any app, because free tutorial how to create keylogger injector is available on underground forums
https://youtu.be/jpmUUuNUIfo

3.79K views13:22

👍 21 👎💬

Android Security & Malware

Forwarded from The Bug Bounty Hunter

Insecure iOS Storage - DVIAv2 Part 1

https://philkeeble.com/ios/Insecure-iOS-Storage/

Offensive Research

Insecure iOS Storage - DVIAv2 Part 1

A guide on how to abuse insecure iOS storage configurations.

891 views14:27

Android Security & Malware

MobOk Malware found on Google Play

Functionality:
-Switching from Wi-Fi to Data Connection
-Subscribing to premium mobile services
-Solving Image-based CAPTCHA using an external image recognition service
-Stealing SMS used for 2FA
-Using the accessibility services to carry-on malicious activities on the screen
https://blog.zimperium.com/zimperium-discovers-mobok-malware-left-undetected-by-mobile-av-industry-for-months/

Zimperium

Zimperium Discovers MobOk Malware Left Undetected by AV Industry for Months - Zimperium

zLabs researchers have uncovered a new variant of the MobOk campaign. The samples found evaded detection by AV vendors for months. Zimperium worked with

3.61K views09:32

👍 14 👎 2 💬

Android Security & Malware

Police cracked encryption in EncroChat to read messages between drug criminals, hitmen and murder orders
https://www.nytimes.com/2020/07/02/world/europe/encrypted-network-arrests-europe.html

NY Times

When Police Are Hackers: Hundreds Charged as Encrypted Network Is Broken

The authorities said that by hacking into EncroChat, they were able to monitor criminal activity in real time, allowing them to stop drug deals and even murder.

4.06K views18:52

👍 20 👎 1 💬