Google Assistant on Pixel devices, was able to capture screenshots even when screens were protected with FLAG_SECURE.
Fixed in September 2019 bulletin
https://pankajupadhyay.in/2020/05/01/ok-google-bypass-flag-secure/
Fixed in September 2019 bulletin
https://pankajupadhyay.in/2020/05/01/ok-google-bypass-flag-secure/
Pankaj Upadhyay
Ok Google! bypass ‘flag_secure’
Google Assistant on Android 9 can bypass the screen-capture protection provided by Android’s FLAG_SECURE.
Aarogya Setu app servers discloses more information then necessary by backend server API.
By changing location you could identify COVID19 infected and unwell people in 500m radius anywhere in India.
https://medium.com/@fs0c131y/aarogya-setu-the-story-of-a-failure-3a190a18e34
By changing location you could identify COVID19 infected and unwell people in 500m radius anywhere in India.
https://medium.com/@fs0c131y/aarogya-setu-the-story-of-a-failure-3a190a18e34
Medium
Aarogya Setu: The story of a failure
In order to fight Covid19, the Indian government released a contact mobile application called Aarogya Setu. This application is available…
Oday iOS XML exploit granted an app full access to the entire file system, and more
https://daringfireball.net/linked/2020/05/02/psychic-paper
https://daringfireball.net/linked/2020/05/02/psychic-paper
Daring Fireball
‘Psychic Paper’, an Extraordinarily Powerful But Easily Understood iOS Exploit
Link to: https://siguza.github.io/psychicpaper/
0-click RCE via MMS
Exploited on Samsung Galaxy Note 10+ phone running Android 10
Analysis: https://bugs.chromium.org/p/project-zero/issues/detail?id=2002
PoC: https://youtu.be/nke8Z3G4jnc
Exploited on Samsung Galaxy Note 10+ phone running Android 10
Analysis: https://bugs.chromium.org/p/project-zero/issues/detail?id=2002
PoC: https://youtu.be/nke8Z3G4jnc
YouTube
Exploitation of a Samsung Galaxy Note 10+ Zero-Click RCE Bug via MMS
Director's cut with a soundtrack: https://youtu.be/ZQnb8kRMkHg.
This video demonstrates the exploitation of a vulnerability in the custom Samsung Qmage image codec via MMS. The exploit proof-of-concept achieves remote code execution with no user interaction…
This video demonstrates the exploitation of a vulnerability in the custom Samsung Qmage image codec via MMS. The exploit proof-of-concept achieves remote code execution with no user interaction…
iOS Static Analysis
-jailbreak
-install IPA apps
-bypass jailbreak detection
-bypass SSL pinning
-keychain dump
https://medium.com/@AbhishekMisal/ios-application-security-static-analysis-cbe7effc6a34
-jailbreak
-install IPA apps
-bypass jailbreak detection
-bypass SSL pinning
-keychain dump
https://medium.com/@AbhishekMisal/ios-application-security-static-analysis-cbe7effc6a34
Medium
iOS Application Security — Static Analysis
In this article, we will look at performing static security of iOS applications starting from jailbreaking an iOS device, installing a…
Bypass SSL Pinning on iOS 13 using Frida & Objection
https://zeroinformationsecurity.wordpress.com/2020/05/07/the-only-way-to-bypass-ssl-pinning-on-ios-13
https://zeroinformationsecurity.wordpress.com/2020/05/07/the-only-way-to-bypass-ssl-pinning-on-ios-13
ZeroInfoSec - James Guthrie
The Only Way to Bypass SSL Pinning on iOS 13 - ZeroInfoSec
Use Frida and Objection! By now you should know how to install Burp Suite and set it up to proxy your iOS device. If this is all you do then you will come up against TLS errors. You have to use Frida and Objection to inject an SSL bypass into the app you're…
How International Users Unwittingly Build up WeChat’s Chinese Censorship Apparatus
https://citizenlab.ca/2020/05/we-chat-they-watch/
https://citizenlab.ca/2020/05/we-chat-they-watch/
The Citizen Lab
We Chat, They Watch
WeChat communications conducted entirely among non-China-registered accounts are subject to pervasive content surveillance that was previously thought to be exclusively reserved for China-registered accounts.
Turkey targeted by Cerberus and Anubis Android banking Trojan campaigns
https://bushidotoken.blogspot.com/2020/05/turkey-targeted-by-cerberus-and-anubis.html
https://bushidotoken.blogspot.com/2020/05/turkey-targeted-by-cerberus-and-anubis.html
blog.bushidotoken.net
Turkey targeted by Cerberus and Anubis Android banking Trojan campaigns
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
Blackloan: Android banking Trojan targets VISA users in China, Vietnam and Malaysia
https://www.freebuf.com/articles/terminal/233411.html
https://www.freebuf.com/articles/terminal/233411.html
Freebuf
Blackloan：针对中国、越南、马来西亚VISA用户的新黑产组织 - FreeBuf网络安全行业门户
近期奇安信病毒响应中心在日常监测中，发现了一批针对中国、越南、马来西亚等国用户的钓鱼APP。
Analysis of accidentally found RCE + LPE in Pi-hole v4.4 and below. CVE-2020-11108
https://frichetten.com/blog/cve-2020-11108-pihole-rce/
https://frichetten.com/blog/cve-2020-11108-pihole-rce/
Frichetten
CVE-2020-11108: How I Stumbled into a Pi-hole RCE+LPE
Writeup for CVE-2020-11108 covering how I found the vulnerability and how it can be exploited for fun/profit.
Untold story of Marcus Hutchins arrest and history of creating Kronos banking malware
https://www.wired.com/story/confessions-marcus-hutchins-hacker-who-saved-the-internet/
https://www.wired.com/story/confessions-marcus-hutchins-hacker-who-saved-the-internet/
WIRED
The Confessions of the Hacker Who Saved the Internet
At 22, Marcus Hutchins put a stop to the worst cyberattack the world had ever seen. Then he was arrested by the FBI. This is his untold story.
Reversing “V-Alert COVID-19” Android/BankBot
https://medium.com/@cryptax/reversing-v-alert-covid-19-android-bankbot-8809c7389f13
https://medium.com/@cryptax/reversing-v-alert-covid-19-android-bankbot-8809c7389f13
Medium
Reversing “V-Alert COVID-19” Android/BankBot
On May 1, 2020, a new version of Android BankBot (aka Anubis, Nautilus Bot) was spotted. The malware poses as an COVID-19 alert…
Forwarded from The Bug Bounty Hunter
iOS Swift Anti-Jailbreak Bypass with Frida https://syrion.me/blog/ios-swift-antijailbreak-bypass-frida/
Deep research on Android Spyware Framework - Mandrake - that is active since 2016
https://www.bitdefender.com/files/News/CaseStudies/study/329/Bitdefender-PR-Whitepaper-Mandrake-creat4464-en-EN-interactive.pdf
https://www.bitdefender.com/files/News/CaseStudies/study/329/Bitdefender-PR-Whitepaper-Mandrake-creat4464-en-EN-interactive.pdf
Tracing iOS Kernel Functions - Building a Kernel Function Trace Tool for Security Research
https://youtu.be/qm_oLQFGRsQ
https://youtu.be/qm_oLQFGRsQ
YouTube
Tracing iOS Kernel Functions - Building a Kernel Function Trace Tool for Security Research
Hey guys! Today we're taking a look at a project I've been working on recently - a kernel function tracing tool!
Hopefully you enjoy!
Follow me on Twitter - https://twitter.com/bellis1000
Hopefully you enjoy!
Follow me on Twitter - https://twitter.com/bellis1000
FBI and CISA shared list of top 10 routinely exploited vulnerabilities
https://www.us-cert.gov/ncas/alerts/aa20-133a
https://www.us-cert.gov/ncas/alerts/aa20-133a
us-cert.cisa.gov
Top 10 Routinely Exploited Vulnerabilities | CISA
The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the broader U.S. Government are providing this technical guidance to advise IT security professionals at public and private sector organizations to…
Android Malware in COVID-19 Clothes Steals SMS and Contacts
https://labs.bitdefender.com/2020/05/android-malware-in-covid-19-clothes-steals-sms-and-contacts/
https://labs.bitdefender.com/2020/05/android-malware-in-covid-19-clothes-steals-sms-and-contacts/
Bitdefender Labs
Android Malware in COVID-19 Clothes Steals SMS and Contacts
Criminals are using an old certificate to sign a malware that takes advantage of
the COVID-19 pandemic situation, preying on people’s need for information.
the COVID-19 pandemic situation, preying on people’s need for information.
Android WolfRAT analysis (new version of DenDroid)
https://blog.talosintelligence.com/2020/05/the-wolf-is-back.html
https://blog.talosintelligence.com/2020/05/the-wolf-is-back.html
Cisco Talos
The wolf is back...
By Warren Mercer, Paul Rascagneres and Vitor Ventura. News summary * Thai Android devices and users are being targeted by a modified version of DenDroid we are calling "WolfRAT," now targeting messaging apps like WhatsApp, Facebook Messenger and Line. * We…
Banking Trojan found on Google Play
Using Accessibility it steals all the displayed text from launched apps (banking apps, SMS, WhatsApp messages, Google Authenticator...)
It can also remotely launch apps, perform controlled clicks, input text...
https://www.welivesecurity.com/2020/05/22/insidious-android-malware-gives-up-all-malicious-features-but-one-gain-stealth/
Using Accessibility it steals all the displayed text from launched apps (banking apps, SMS, WhatsApp messages, Google Authenticator...)
It can also remotely launch apps, perform controlled clicks, input text...
https://www.welivesecurity.com/2020/05/22/insidious-android-malware-gives-up-all-malicious-features-but-one-gain-stealth/
WeLiveSecurity
Insidious Android malware gives up all malicious features but one to gain stealth
ESET researchers have analyzed an extremely dangerous Android app that can wipe out the victim’s bank account or cryptocurrency wallet and take over their email or social media accounts. Called "DEFENSOR ID", the banking trojan requires a single action from…