Android Security & Malware

Android arbitrary code execution
Frida script that helps to identify potential ACE dynamically
https://github.com/androidmalware/android_frida_scripts#1-file_existsjs

GitHub

GitHub - androidmalware/android_frida_scripts

Contribute to androidmalware/android_frida_scripts development by creating an account on GitHub.

6.2K views12:16

👍 27 👎💬

Android Security & Malware

Samsung S20 - RCE via Samsung Galaxy Store App
https://labs.f-secure.com/blog/samsung-s20-rce-via-samsung-galaxy-store-app/

10.3K views23:33

👍 19 👎💬

Android Security & Malware

Getting remote access to PC with Android via USB
https://youtu.be/PJbqZm73MOc

6.78K views11:36

👍 16 👎 1 💬

Android Security & Malware

Link previews in chat apps can cause serious privacy problems
There were found several cases of apps with vulnerabilities such as: leaking IP addresses, exposing links sent in end-to-end encrypted chats, and unnecessarily downloading gigabytes of data quietly in the background
https://www.mysk.blog/2020/10/25/link-previews/

Mysk Blog – In-Depth Cybersecurity & Mobile App Privacy Research

Link Previews: How a Simple Feature Can Have Privacy and Security Risks

Link previews in chat apps can cause serious privacy problems if not done properly. We found several cases of apps with vulnerabilities such as: leaking IP addresses, exposing links sent in end-to-end encrypted chats, and unnecessarily downloading gigabytes…

6.38K views12:47

👍 18 👎 1 💬

Android Security & Malware

On Google Play were found 21 gaming apps that were packed with hidden adware
https://blog.avast.com/new-malware-apps-on-google-play-avast
IoC: https://docs.google.com/spreadsheets/d/1Cu6KVYG6VWWCZMY0A-vXlewXyfm7yd0djQtTzc82cyY/edit#gid=0

Avast

Another 21 malware apps found on Google Play

Avast has uncovered another set of malicious apps in the Google Play Store. While adware is hidden by design, there are steps each person can take to protect themselves and their families.

7.24K views11:44

👍 22 👎 4 💬

Android Security & Malware

Android banking malware grew in Q3 with its detections more than four times compared to Q2
https://www.welivesecurity.com/wp-content/uploads/2020/10/ESET_Threat_Report_Q32020.pdf

6.53K views08:12

👍 23 👎 2 💬

Android Security & Malware

DoNot Android APT group targets India, Pakistan and the Kashmir crisis
https://blog.talosintelligence.com/2020/10/donot-firestarter.html

Cisco Talos

DoNot’s Firestarter abuses Google Firebase Cloud Messaging to spread

By Warren Mercer, Paul Rascagneres and Vitor Ventura. * The newly discovered Firestarter malware uses Google Firebase Cloud Messaging to notify its authors of the final payload location. * Even if the command and control (C2) is taken down, the DoNot team…

6.03K views08:16

👍 8 👎 1 💬

Android Security & Malware

Trend Micro CTF 2020 — Android Keybox writeup
https://tatocaster.medium.com/trend-micro-ctf-2020-keybox-writeup-cf5a69d2d091

Medium

Trend Micro CTF 2020 — Keybox writeup

Given Android app is called Keybox. it is a container for the flag and all the hints to it. The flag is encrypted

6.62K views08:23

👍 16 👎💬

Android Security & Malware

How to monitor Wi-Fi networks using Samsung S7 (link with tutorial, how to install NetHunter, prerequisites, wifi adapter support list, ROM)
https://www.instagram.com/reel/CHF3snlAOOa/

👏1

8.31K viewsedited 15:07

👍 33 👎💬 1

Android Security & Malware

Lockscreen and Authentication Improvements in Android 11
https://security.googleblog.com/2020/09/lockscreen-and-authentication.html

Google Online Security Blog

Lockscreen and Authentication Improvements in Android 11

Posted by Haining Chen, Vishwath Mohan, Kevin Chyn and Liz Louis, Android Security Team [Cross-posted from the Android Developers Blog ] ...

7.37K views08:49

👍 20 👎💬

Android Security & Malware

Bypass SSL pinning on iOS 8 to iOS 14
https://github.com/evilpenguin/SSLBypass

GitHub

GitHub - evilpenguin/SSLBypass: iOS SSL Pinning Bypass (iOS 8 - 14)

iOS SSL Pinning Bypass (iOS 8 - 14). Contribute to evilpenguin/SSLBypass development by creating an account on GitHub.

10.5K views12:01

👍 26 👎💬

Android Security & Malware

APKProxyHelper paches an apk for proxying
https://github.com/evilpenguin/APKProxyHelper

GitHub

GitHub - evilpenguin/APKProxyHelper: Patches those pesky APKs for proxy use.

Patches those pesky APKs for proxy use. Contribute to evilpenguin/APKProxyHelper development by creating an account on GitHub.

5.95K views08:04

👍 20 👎 2 💬

Android Security & Malware

How to identify dynamically loaded binaries in Android apps. Useful for Bug Bounty and malware analysis of dynamically loaded payloads
Commands
# ps | grep "APP_NAME"
# cat /proc/PID/maps | grep "/data/data/"
Demo: https://www.instagram.com/tv/CHXv3iBAJ5V/
Info: https://sayfer.io/blog/dynamic-loading-in-android-applications-with-proc-maps/

Sayfer

Detecting Dynamic Loading in Android Applications With /proc/maps - Sayfer

Through dynamic loading malware authors can covertly load malicious code into their application in order to avoid detection. We can detect such loading...

5.82K viewsedited 14:27

👍 25 👎 2 💬

Android Security & Malware

New Android banking trojan - Ghimob - targets 122 financial institutions mainly in Brazil
https://securelist.com/ghimob-tetrade-threat-mobile-devices/99228/

Securelist

Ghimob: a Tétrade threat actor moves to infect mobile devices

Guildma's new creation, the Ghimob banking trojan, has been a move toward infecting mobile devices, targeting financial apps from banks, fintechs, exchanges and cryptocurrencies.

5.64K views08:45

👍 16 👎 1 💬