Android Security & Malware

Protecting Android users from 0-Day attacks

Description of 3 campaigns delivered one-time links mimicking URL shortener services to the targeted Android users via email. Once clicked, the link redirected the target to an attacker-owned domain that delivered the exploits before redirecting the browser to a legitimate website.

Compromise flow:
website redirect -> deliver browser exploit -> load ALIEN malware -> load PREDATOR payload
https://blog.google/threat-analysis-group/protecting-android-users-from-0-day-attacks/

Google

Protecting Android users from 0-Day attacks

To protect our users, Google’s Threat Analysis Group (TAG) routinely hunts for 0-day vulnerabilities exploited in-the-wild. In 2021, we reported nine 0-days affecting Ch…

👍12

8.22K views22:31

👍 11 👎💬

Android Security & Malware

Android security checklist: theft of arbitrary files
https://blog.oversecured.com/Android-security-checklist-theft-of-arbitrary-files/

News, Techniques & Guides

Android security checklist: theft of arbitrary files

Developers for Android do a lot of work with files and exchange them with other apps, for example, to get photos, images, or user data.

🔥12👍5

7.71K views14:36

👍 16 👎 1 💬

Android Security & Malware

Weaponizing dirtypipe vulnerability on Android
https://docs.google.com/presentation/d/1Tq00gy1GtiK0OvNYOy_kCz0er9ZECBXGoy5Lfy5MD3M/mobilepresent#slide=id.p

Google Docs

Weaponizing dirtypipe on android

Weaponizing dirtypipe on android Tales of challenges and complexities

👍2🔥2

7.45K views12:26

👍 22 👎 2 💬

Android Security & Malware

Anti-Frida - Techniques to Detect Frida
https://github.com/apkunpacker/Anti-Frida

GitHub

GitHub - apkunpacker/Anti-Frida: Some Of Anti-Frida Stuff

Some Of Anti-Frida Stuff . Contribute to apkunpacker/Anti-Frida development by creating an account on GitHub.

👍11

7.21K views11:27

👍 25 👎 2 💬

Android Security & Malware

New version of Android banking trojan ERMAC 2.0 is available on the underground market and already has an active campaign https://blog.cyble.com/2022/05/25/ermac-back-in-action/

Cyble

ERMAC Malware Back In Action: New Threats And Attack Methods

ERMAC malware is back with improved capabilities, targeting Android devices with enhanced threat techniques. Learn about its actions, impact, and how to defend against this evolving mobile malware

🔥7👍6

6.23K views15:05

Android Security & Malware

Notification implicit PendingIntent in Android NextCloud app allows to access contacts (CVE-2022-24886) https://hackerone.com/reports/1161401

HackerOne

Nextcloud disclosed on HackerOne: Notification implicit...

Advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5cj3-v98r-2wmq

👍5

5.87K views09:17

👍 13 👎 1 💬

Android Security & Malware

Mobile threat evolution in Q1 2022 by Kaspersky
https://securelist.com/it-threat-evolution-in-q1-2022-mobile-statistics/106589/

Securelist

IT threat evolution in Q1 2022. Mobile statistics

According to Kaspersky Security Network, in Q1 2022 516,617 mobile malware installation packages were detected, of which 53,947 packages were related to mobile banking trojans, and 1,942 packages were mobile ransomware trojans.

👍2

5.96K views11:48

👍 6 👎 1 💬

Android Security & Malware

GhostTouch: Targeted Attacks on Touchscreens without Physical Touch
The core idea is to take advantage of the electromagnetic signals to inject fake touch events such as taps and swipes into targeted locations of the touchscreen with the goal of taking over remote control and manipulating the underlying device
https://www.usenix.org/conference/usenixsecurity22/presentation/wang-kai

👍11🔥4

5.99K views13:13

👍 21 👎 2 💬

Android Security & Malware

Android apps with millions of downloads exposed to high-severity vulnerabilities
http://www.microsoft.com/security/blog/2022/05/27/android-apps-with-millions-of-downloads-exposed-to-high-severity-vulnerabilities/

Microsoft News

Android apps with millions of downloads exposed to high-severity vulnerabilities

Microsoft uncovered high-severity vulnerabilities in a mobile framework used by multiple large mobile service providers in pre-installed Android System apps that potentially exposed users to remote or local attacks.

👍14

6.39K views18:22

👍 24 👎💬

Android Security & Malware