Android Icon-hiding Adware found on Google Play
Seven apps with altogether over 700,000 installs.
https://twitter.com/s_metanka/status/1155824374177587201
Seven apps with altogether over 700,000 installs.
https://twitter.com/s_metanka/status/1155824374177587201
Twitter
smtnk
#Android Icon-hiding #Adware on @GooglePlay, 700,000+ installs in total https://t.co/1avSCWJPOH https://t.co/pnhobY4w4q https://t.co/n8gzNOZgT3 https://t.co/njdp7VH3kT https://t.co/32PXVpgSRQ https://t.co/Hb89SDVZAx https://t.co/KjcYfJ4OTX
HiddenAd Adware with 500,000 installs found on Google Play
https://twitter.com/ESETresearch/status/1156551255701020672?s=19
https://twitter.com/ESETresearch/status/1156551255701020672?s=19
Twitter
ESET research
Beware of sneaky #Android adware lurking among Trending Photography apps on #GooglePlay! @LukasStefanko #reported it. #ESETresearch #cybersecurity https://t.co/wHuyfc5iaA
Introducing new #Android #malware analysis platform!
Upload APK, detect malware and grab its configuration.
Currently open for trusted researchers only.
https://www.apkdetect.com/
Upload APK, detect malware and grab its configuration.
Currently open for trusted researchers only.
https://www.apkdetect.com/
Riltok - Android banking Trojan spreads in France 🇫🇷 via SMS
https://twitter.com/benkow_/status/1165905380402171905?s=19
https://twitter.com/benkow_/status/1165905380402171905?s=19
Twitter
Benkøw moʞuƎq
#Riltok #Android still around in France https://karambga3j. net/3lfk3jGj/fKJh3jKLO/login.php f51a27163cb0ddd08caa29d865b9f238848118ba2589626af711330481b352df
Fake VPN app found on Google Play can download and install additional apps.
https://twitter.com/m0br3v/status/1166680295023812609?s=19
https://twitter.com/m0br3v/status/1166680295023812609?s=19
Twitter
I.Zhilyakov
Fake VPN client has been found and removed from Google Play. On command: -opens web, #instagram, #telegram and google play pages -downloads and tries to install other applications ioc: d789d13c6187ad3cd2991b6d387d9e943d394a8c #android #trojan #malware
Two spy apps that steal contact list found on Google Play with 110+ installs
https://twitter.com/s_metanka/status/1181192866875559936
https://twitter.com/s_metanka/status/1181192866875559936
Twitter
smtnk
These two young apps on @GooglePlay steal the users' contact lists and leak them all (~3k unique records) via unprotected Firebase instances, mostly UAE/Pakistan/Saudi Arabia victims it seems. #Android #Malware https://t.co/6INCOHBiLE https://t.co/o1mPKjrHNr
New Joker Trojan app with 100,000+ installs found on Google Play
https://twitter.com/s_metanka/status/1181592422796664837
https://twitter.com/s_metanka/status/1181592422796664837
Twitter
smtnk
A new Joker app on @GooglePlay ”Amusing game station" - 100,000+ installs. The loader is slightly improved, the core build is an old s8-7-release. Targets: GR,AT,DE,PK,UAE,BD,TH. Distribution C&C: doocims[.]com, main C&C: 18.139.46[.]15 https://t.co/NXfFLZz6rD…
RCE Vulnerability found in Android
CVE-2019-2205 - memory corruption due to a use after free could lead to RCE
It was fixed in the latest Android Security Bulletin—November 2019. Update!
https://www.nowsecure.com/blog/2019/11/13/nowsecure-discovers-critical-android-vuln-that-may-lead-to-remote-code-execution/
CVE-2019-2205 - memory corruption due to a use after free could lead to RCE
It was fixed in the latest Android Security Bulletin—November 2019. Update!
https://www.nowsecure.com/blog/2019/11/13/nowsecure-discovers-critical-android-vuln-that-may-lead-to-remote-code-execution/
Nowsecure
Critical Android Vuln May Hide Remote Code Execution - NowSecure Blog
In the course of performing Android application security testing, I suspected that a library called libpac might be vulnerable to exploit. This vulnerability has been assigned CVE-2019-2205. Google deployed a fix and we recommend all users apply it to secure…
What a interesting vulnerability in HockeyApp platform #Android #iOS #BugBounty
Leaked API key allowed:
-fetch internal employee contacts
-distribute #malware directly to devices of organization employees as internal app update
+PoC Metasploit scenario
https://www.allysonomalley.com/2020/01/06/saying-goodbye-to-my-favorite-5-minute-p1/
Leaked API key allowed:
-fetch internal employee contacts
-distribute #malware directly to devices of organization employees as internal app update
+PoC Metasploit scenario
https://www.allysonomalley.com/2020/01/06/saying-goodbye-to-my-favorite-5-minute-p1/
allysonomalley.com
Saying Goodbye to my Favorite 5 Minute P1
In this post, I’m going to reveal the fastest, easiest P1 that I’ve ever reported – multiple times! It’s the sort of oversight that seems so simple to avoid, but surprisingl…
What to Look for When Reverse Engineering Android Apps
https://www.nowsecure.com/blog/2020/02/26/what-to-look-for-when-reverse-engineering-android-apps/
https://www.nowsecure.com/blog/2020/02/26/what-to-look-for-when-reverse-engineering-android-apps/
Nowsecure
What to Look for When Reverse Engineering Android Apps - NowSecure
This tutorial will help you master the basics of analyzing an Android app and knowing what to look for as you work to reverse engineer the product.
Android SLocker uses Coronavirus scare to lock smartphones
https://labs.bitdefender.com/2020/05/android-slocker-variant-uses-coronavirus-scare-to-take-android-hostage/
https://labs.bitdefender.com/2020/05/android-slocker-variant-uses-coronavirus-scare-to-take-android-hostage/
Bitdefender Labs
Android SLocker Variant Uses Coronavirus Scare to Take Android Hostage
The coronavirus pandemic is an opportunity for criminals who try to take advantage of people’s thirst for information. Unfortunately, Android users can fall prey to... #android #covid19 #ransomware
Android Malware in COVID-19 Clothes Steals SMS and Contacts
https://labs.bitdefender.com/2020/05/android-malware-in-covid-19-clothes-steals-sms-and-contacts/
https://labs.bitdefender.com/2020/05/android-malware-in-covid-19-clothes-steals-sms-and-contacts/
Bitdefender Labs
Android Malware in COVID-19 Clothes Steals SMS and Contacts
Criminals are using an old certificate to sign a malware that takes advantage of
the COVID-19 pandemic situation, preying on people’s need for information.
the COVID-19 pandemic situation, preying on people’s need for information.
Apps on Google Play Tainted with Cerberus Banker Malware
https://labs.bitdefender.com/2020/09/apps-on-google-play-tainted-with-cerberus-banker-malware/
https://labs.bitdefender.com/2020/09/apps-on-google-play-tainted-with-cerberus-banker-malware/
Bitdefender Labs
Daily source of cyber-threat information. Established 2001.
A Year in Review of 0-days Used In-the-Wild in 2021 by Google
In 2021 there were 7 #Android in-the-wild 0-days detected and disclosed:
- Qualcomm Adreno GPU driver (CVE-2020-11261, CVE-2021-1905, CVE-2021-1906)
- ARM Mali GPU driver (CVE-2021-28663, CVE-2021-28664)
- Upstream Linux kernel (CVE-2021-1048, CVE-2021-0920)
For the 5 total #iOS and macOS in-the-wild 0-days, they targeted 3 different attack surfaces:
- IOMobileFrameBuffer (CVE-2021-30807, CVE-2021-30883)
- XNU Kernel (CVE-2021-1782 & CVE-2021-30869)
- CoreGraphics (CVE-2021-30860)
- CommCenter (FORCEDENTRY sandbox escape - CVE requested, not yet assigned)
https://googleprojectzero.blogspot.com/2022/04/the-more-you-know-more-you-know-you.html
In 2021 there were 7 #Android in-the-wild 0-days detected and disclosed:
- Qualcomm Adreno GPU driver (CVE-2020-11261, CVE-2021-1905, CVE-2021-1906)
- ARM Mali GPU driver (CVE-2021-28663, CVE-2021-28664)
- Upstream Linux kernel (CVE-2021-1048, CVE-2021-0920)
For the 5 total #iOS and macOS in-the-wild 0-days, they targeted 3 different attack surfaces:
- IOMobileFrameBuffer (CVE-2021-30807, CVE-2021-30883)
- XNU Kernel (CVE-2021-1782 & CVE-2021-30869)
- CoreGraphics (CVE-2021-30860)
- CommCenter (FORCEDENTRY sandbox escape - CVE requested, not yet assigned)
https://googleprojectzero.blogspot.com/2022/04/the-more-you-know-more-you-know-you.html
Blogspot
The More You Know, The More You Know You Don’t Know
A Year in Review of 0-days Used In-the-Wild in 2021 Posted by Maddie Stone, Google Project Zero This is our third annual year in rev...
🔥7👍3❤1🥰1👏1
Spyware vendor targets users in Italy and Kazakhstan #Android #iOS #Hermit
https://blog.google/threat-analysis-group/italian-spyware-vendor-targets-users-in-italy-and-kazakhstan/
https://blog.google/threat-analysis-group/italian-spyware-vendor-targets-users-in-italy-and-kazakhstan/
Google
Spyware vendor targets users in Italy and Kazakhstan
Today, alongside Google’s Project Zero, we are detailing capabilities provided by RCS Labs, an Italian vendor that uses a combination of tactics, including atypical drive-by downloads as initial infection vectors to target mobile users on both iOS and Android.
👍14
Bypassing Frida detection in Android
https://www.youtube.com/watch?v=M0ETKs6DZn8
https://www.youtube.com/watch?v=M0ETKs6DZn8
YouTube
Bypassing Frida detection in Android
#frida #rootdetection #fridadetection #android #pentest #r2pay
Hello everyone, in this video we are going to learn some new techniques which are used in android app for detecting frida based on some frida artifacts in the memory and filesystem.
For learning…
Hello everyone, in this video we are going to learn some new techniques which are used in android app for detecting frida based on some frida artifacts in the memory and filesystem.
For learning…
🔥8👍6❤1
Emulating Android native library to decrypt strings using Qiling Framework
https://youtu.be/R1zWh3fbY24
https://youtu.be/R1zWh3fbY24
YouTube
Emulating Android library to decrypt strings (Qiling Framework)
#android #mobilesecurity #emulation #qilingframework #reversengineering #pentest
In this video we are going to see how to extract encrypted strings present inside a native library of an android app which are used in performing various environmental checks…
In this video we are going to see how to extract encrypted strings present inside a native library of an android app which are used in performing various environmental checks…
👍9
Bypassing advance root detections using Frida
Techniques learned from video:
-presence of SU binary
-SELinux policies
-mountinfo
-attr/prev
-looking for SU bin paths using Supervisor calls
Video: https://youtu.be/7KqPwxlA-00
Scripts and POCs: https://github.com/fatalSec/in-app-protections
Techniques learned from video:
-presence of SU binary
-SELinux policies
-mountinfo
-attr/prev
-looking for SU bin paths using Supervisor calls
Video: https://youtu.be/7KqPwxlA-00
Scripts and POCs: https://github.com/fatalSec/in-app-protections
YouTube
Bypassing advance root detections using Frida
#mobilesecurity #rootdetection #android #mobilepentesting #reverseengineering #radare2 #arm64
Hello everyone, hope you all are doing good.
In this video, we are going to learn various different techniques used by app developers to protect their app from…
Hello everyone, hope you all are doing good.
In this video, we are going to learn various different techniques used by app developers to protect their app from…
🔥17👍12❤3