Android Security & Malware

Xiaomi HyperOS BootLoader Bypass
A PoC that exploits a vulnerability to bypass the Xiaomi HyperOS community restrictions of BootLoader unlocked account bindings
https://github.com/MlgmXyysd/Xiaomi-HyperOS-BootLoader-Bypass#xiaomi-hyperos-bootloader-bypass

GitHub

GitHub - MlgmXyysd/Xiaomi-HyperOS-BootLoader-Bypass: A PoC that exploits a vulnerability to bypass the Xiaomi HyperOS community…

A PoC that exploits a vulnerability to bypass the Xiaomi HyperOS community restrictions of BootLoader unlocked account bindings. - MlgmXyysd/Xiaomi-HyperOS-BootLoader-Bypass

👍17👏3❤2

14.4K views06:10

👍 27 👎 3

Android Security & Malware

Deobfuscating Android ARM64 strings with Ghidra: Emulating, Patching, and Automating
https://blog.nviso.eu/2024/01/15/deobfuscating-android-arm64-strings-with-ghidra-emulating-patching-and-automating/

NVISO Labs

Deobfuscating Android ARM64 strings with Ghidra: Emulating, Patching, and Automating

In a recent engagement I had to deal with some custom encrypted strings inside an Android ARM64 app. I had a lot of fun reversing the app and in the process I learned a few cool new techniques whic…

👍17

8.66K views09:29

👍 39 👎

Android Security & Malware

A lightweight method to detect potential iOS malware
https://securelist.com/shutdown-log-lightweight-ios-malware-detection-method/111734/

Securelist

Detecting iOS malware via Shutdown.log file

Analyzing Shutdown.log file as a lightweight method to detect indicators of infection with sophisticated iOS malware such as Pegasus, Reign and Predator.

👍9

8.71K views18:26

👍 24 👎

Android Security & Malware

XSS & Command Injection in Android — MobileHackingLab ‘Post Board’ Write-up
https://ajmal-moochingal.medium.com/xss-command-injection-in-android-mobilehackinglab-post-board-write-up-ae9497829615

Medium

XSS & Command Injection in Android — MobileHackingLab ‘Post Board’ Write-up

A lab that covers XSS in a WebView within Android which could be exploited by other apps in the device, combined with a Command Injection…

👍18🤡6❤1

9.16K views06:48

👍 24 👎 1

Android Security & Malware

Bigpanzi botnet infects 170,000 Android TV boxes with malware
https://blog.xlab.qianxin.com/bigpanzi-exposed-hidden-cyber-threat-behind-your-stb/

奇安信 X 实验室

Bigpanzi Exposed: The Hidden Cyber Threat Behind Your Set-Top Box

Background

Some time ago, we intercepted a dubious ELF sample exhibiting zero detection on VirusTotal. This sample, named pandoraspear and employing a modified UPX shell, has an MD5 signature of 9a1a6d484297a4e5d6249253f216ed69. Our analysis revealed that…

👍13

9.27K views07:46

👍 17 👎

Android Security & Malware

MavenGate: a supply chain attack method for Java and Android applications
https://blog.oversecured.com/Introducing-MavenGate-a-supply-chain-attack-method-for-Java-and-Android-applications/

News, Techniques & Guides

Introducing MavenGate: a supply chain attack method for Java and Android applications

More recently, the cybersecurity community has seen numerous studies of supply chain attacks on Web apps.

👍14❤1

8.96K views17:11

👍 18 👎

Android Security & Malware

Getting Started with iOS Penetration Testing — Part 1: The Setup
https://sahil-security-nerd07.medium.com/getting-started-with-ios-penetration-testing-part-1-the-setup-e322c73ab9a0

Medium

Getting Started with iOS Penetration Testing, The Setup.

Introduction:

🔥19🥱5👍3❤1

10.1K views05:21

👍 30 👎 7

Android Security & Malware

2023_Mobile_Banking_Heists_Report.pdf

13.3 MB

Mobile Banking Heists Report 2023: 29 Malware Families Targeting 1,800 Mobile Banking Apps

👍18

8.9K views07:44

👍 32 👎 1

Android Security & Malware

Mobile malware analysis for the BBC of TeaBot (Anatsa) banking trojan impersonating PDF AI: Add-On app
https://www.pentestpartners.com/security-blog/mobile-malware-analysis-for-the-bbc/

Pentestpartners

Mobile malware analysis for the BBC | Pen Test Partners

This is a version of our report referenced in the Helping a mobile malware fraud victim blog post, with all sensitive information removed. Summary One malicious application was identified on the device, and evidence identified during the examination strong…

🔥5🤡4🙈3👍2👎2

8.67K views15:21

👍 16 👎 4

Android Security & Malware

PoC to takeover Android using another Android by exploiting critical Bluetooth vulnerability to install Metasploit without proper Bluetooth pairing (CVE-2023-45866). It still affects Android 10 and bellow.
https://www.mobile-hacker.com/2024/01/23/exploiting-0-click-android-bluetooth-vulnerability-to-inject-keystrokes-without-pairing/

Mobile Hacker

Exploiting 0-click Android Bluetooth vulnerability to inject keystrokes without pairing Mobile Hacker

[update 2024-02-19] This vulnerability can be even used to remotely wipe data of targeted Android smartphone. Using this vulnerability it is possible to guess user lock screen PIN. After five incorrect PINs device is locked out for 30 seconds. This operation…

👍19🔥10🤡5❤2

10.1K views09:37

👍 38 👎 4

Android Security & Malware

Hunting for Android Privilege Escalation with a 32 Line Fuzzer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/hunting-for-android-privilege-escalation-with-a-32-line-fuzzer/

Levelblue

Hunting for Android Privilege Escalation with a 32 Line Fuzzer

Trustwave SpiderLabs tested a couple of Android OS-based mobile devices to conduct the research on privilege escalation scenarios.

👍7

8.75K views09:32

👍 29 👎 2

Android Security & Malware

Pakistan-based Threat Actor Targets Indians with Fake Loan Android Application
https://www.cyfirma.com/outofband/pakistan-based-threat-actor-targets-indians-with-fake-loan-android-application/

CYFIRMA

Pakistan-based Threat Actor Targets Indians with Fake Loan Android Application - CYFIRMA

EXECUTIVE SUMMARY The team at CYFIRMA recently identified a pattern where unknown threat actors utilize Android malware to target individuals...

🤣18👍8👎5

9.22K views14:59

👍 20 👎 3

Android Security & Malware

Android-based PAX Technology Point of Sale (POS) vulnerabilities
CVE-2023-42133 - Reserved
CVE-2023-42134 - Signed partition overwrite and subsequently local code execution as root via hidden bootloader command
CVE-2023-42135 - Local code execution as root via kernel parameter injection in fastboot
CVE-2023-42136 - Privilege escalation from any user/application to system user via shell injection binder-exposed service
CVE-2023-42137 - Privilege escalation from system/shell user to root via insecure operations in systool_server daemon
CVE-2023-4818 - Bootloader downgrade via improper tokenization
https://blog.stmcyber.com/pax-pos-cves-2023/

STM Cyber Blog

Android-based PAX POS vulnerabilities (Part 1) - STM Cyber Blog

In this article, we present details of 6 vulnerabilities on the Android POS devices made by the worldwide known company PAX Technology.

👍13

8.33K views10:46

👍 24 👎

Android Security & Malware

Android Deep Links & WebViews Exploitations Part I
https://medium.com/@justmobilesec/deep-links-webviews-exploitations-part-i-452e8aad124f

Medium

Deep Links & WebViews Exploitations Part I

TLDR: This post is the first of a two-part series covering Deep Links & WebViews Exploitations. This article focuses on WebViews. It…

👍15

8K views11:55

👍 24 👎 1

Android Security & Malware

APK Obfucation Detection - detect code obfuscation through text classification in the detection process
https://github.com/liansecurityOS/apk-obfucation-detection

GitHub

GitHub - liansecurityOS/apk-obfucation-detection: Detect code obfuscation through text classification in the detection process.

Detect code obfuscation through text classification in the detection process. - liansecurityOS/apk-obfucation-detection

👍18👎2❤1

7.9K views09:32

👍 18 👎 4

Android Security & Malware

Buffer-overflow in Android native code — MobileHackingLab ‘Notekeeper’ Write-up
https://ajmal-moochingal.medium.com/buffer-overflow-in-android-native-code-mobilehackinglab-notekeeper-write-up-4e7764be3c2a

Medium

Buffer-overflow in Android native code — MobileHackingLab ‘Notekeeper’ Write-up

Exploiting a Buffer-overflow bug in a native library function in an Android App to gain code execution.

🔥8👍5❤2