Vulnerabilities found in Android baseband firmware could be exploited via AT commands for vulnerable devices to: get unique identifiers, such as their IMEI and IMSI numbers, downgrade a target’s connection in order to intercept phone calls, forward calls to another phone or block all phone calls and internet access altogether.
https://techcrunch.com/2019/11/08/android-baseband-flaws/
Research: https://www.documentcloud.org/documents/6543391-ATFuzzer.html
https://techcrunch.com/2019/11/08/android-baseband-flaws/
Research: https://www.documentcloud.org/documents/6543391-ATFuzzer.html
TechCrunch
Exclusive: Baseband attacks can spy on popular Android phones
The vulnerabilities affect at least ten popular Android devices, including Google's Pixel 2 and Samsung's Galaxy S8+.
RCE Vulnerability found in Android
CVE-2019-2205 - memory corruption due to a use after free could lead to RCE
It was fixed in the latest Android Security Bulletin—November 2019. Update!
https://www.nowsecure.com/blog/2019/11/13/nowsecure-discovers-critical-android-vuln-that-may-lead-to-remote-code-execution/
CVE-2019-2205 - memory corruption due to a use after free could lead to RCE
It was fixed in the latest Android Security Bulletin—November 2019. Update!
https://www.nowsecure.com/blog/2019/11/13/nowsecure-discovers-critical-android-vuln-that-may-lead-to-remote-code-execution/
Nowsecure
Critical Android Vuln May Hide Remote Code Execution - NowSecure Blog
In the course of performing Android application security testing, I suspected that a library called libpac might be vulnerable to exploit. This vulnerability has been assigned CVE-2019-2205. Google deployed a fix and we recommend all users apply it to secure…
Compromise of Xiaomi Mi6 over WiFi to achieve RCE
Bug chaining:
MITM -> JavaScript Bridge (downloadAndInstallApk()) -> Contact Provider vulnerability (auto-start APK) -> RCE
https://labs.f-secure.com/advisories/xiaomi-wifi/
Bug chaining:
MITM -> JavaScript Bridge (downloadAndInstallApk()) -> Contact Provider vulnerability (auto-start APK) -> RCE
https://labs.f-secure.com/advisories/xiaomi-wifi/
Malware found preinstalled in classic push-button phones sold in Russia
https://therecord.media/malware-found-preinstalled-in-classic-push-button-phones-sold-in-russia/
https://therecord.media/malware-found-preinstalled-in-classic-push-button-phones-sold-in-russia/
therecord.media
Malware found preinstalled in classic push-button phones sold in Russia
A security researcher has discovered malicious code inside the firmware of four low-budget push-button mobile phones sold through Russian online stores.
Rudroid - Writing the World's worst Android Emulator in Rust
https://fuzzing.science/page/rudroid-worlds-worst-android-emulator/
https://fuzzing.science/page/rudroid-worlds-worst-android-emulator/
FORCEDENTRY - NSO Group iMessage Zero-Click Exploit Captured in the Wild (CVE-2021-30860 - processing a maliciously crafted PDF may lead to arbitrary code execution)
https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/
https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/
The Citizen Lab
FORCEDENTRY
While analyzing the phone of a Saudi activist infected with NSO Group’s Pegasus spyware, we discovered a zero-day zero-click exploit against iMessage. The exploit, which we call FORCEDENTRY, targets Apple’s image rendering library, and was effective against…
This media is not supported in your browser
VIEW IN TELEGRAM
Are you a starting out web dev with no money? Have no skills in setting up multiple websites in a cheap server....?
Sign up to Digital Ocean https://m.do.co/c/3adf8647a767 get 100 free credits and ping me for container e.g Docker, lxd and ansible scripts that will make you learn without straining the process.
Sign up to Digital Ocean https://m.do.co/c/3adf8647a767 get 100 free credits and ping me for container e.g Docker, lxd and ansible scripts that will make you learn without straining the process.
Android WebViews use and abuse
https://docs.google.com/presentation/d/18xhCZ4fnC2UC4FZ7w_zEIKfiejckn86JU1RqGxvEhTM/mobilepresent?slide=id.g1006589e594_0_3
https://docs.google.com/presentation/d/18xhCZ4fnC2UC4FZ7w_zEIKfiejckn86JU1RqGxvEhTM/mobilepresent?slide=id.g1006589e594_0_3
Google Docs
AS - WebViews
APPLICATION SECURITY (Threats and Malpractices) Speaker: Dimitrios Valsamaras | @Ch0pin https://www.linkedin.com/in/valsamaras/
https://awsome.thesagemalibu.ml/2021/11/wifi-proxy-mobile-wifi-repeater-android.html
Using your mobile as a repeater? Here's how to work smartly on your desktop..
Using your mobile as a repeater? Here's how to work smartly on your desktop..
awsome.thesagemalibu.ml
Wifi proxy + Mobile Wifi Repeater (Android)
Wifi proxy + Mobile Wifi Repeater (Android), thesageMalibu, Wifi proxy + Mobile Wifi Repeater (Android)
IP address leak (Android), and denial of service (DoS) dubbed Message of Death (Android) found in Android Microsoft Teams app https://positive.security/blog/ms-teams-1-feature-4-vulns
positive.security
MS Teams: 1 feature, 4 vulnerabilities | Positive Security
Microsoft Team's link preview feature is susceptible to spoofing and vulnerable to Server-Side Request Forgery. Team's Android users can be DoS'ed and, in the past, their IP address could be leaked.
Facebook android webview vulnerability: Execute arbitrary javascript (xss) and load arbitrary website
https://servicenger.com/mobile/facebook-android-webview-vulnerability/
https://servicenger.com/mobile/facebook-android-webview-vulnerability/
Building userDebug Android images with root access and debug capabilities for a Google Pixel (sailfish)
https://www.linkedin.com/pulse/building-userdebug-android-images-google-pixel-sailfish-basanta
https://www.linkedin.com/pulse/building-userdebug-android-images-google-pixel-sailfish-basanta
Linkedin
Building userDebug Android images for a Google Pixel (sailfish).
Beforehand, i'm sorry for my english writing. I'm in practice for improve it.
RCE in Adobe Acrobat Reader for Android (CVE-2021-40724)
analysis: https://hulkvision.github.io/blog/post1/
analysis: https://hulkvision.github.io/blog/post1/
If your PC lags while using Android studio, use your terminal to launch it with the following arguments
JAVA_OPTS="-Xmx4g" /path-to-your-launch-script eg /user/local/android-studio/bin/studio.sh
That will allocate a 4Gb's heap in ram for android studio,,,if you have more ram, you can play around with that number for better perfomance eg -Xmx6g ,,,blah blah...happy coding 🥳🥳 #AndroidTricks
JAVA_OPTS="-Xmx4g" /path-to-your-launch-script eg /user/local/android-studio/bin/studio.sh
That will allocate a 4Gb's heap in ram for android studio,,,if you have more ram, you can play around with that number for better perfomance eg -Xmx6g ,,,blah blah...happy coding 🥳🥳 #AndroidTricks