We were recently made aware of multiple potential DNS leaks on Android. They stem from bugs in Android itself, and only affect certain apps.

Finland's Transport and Communications Agency (Traficom) has issued a warning about an ongoing Android malware campaign targeting banking accounts.

Intro Recently I have been getting into userland application testing on Android. I want to credit Iddo and Jacob for their excellent course on attacking IM Applications which I took at zer0con. As a …

I recently worked on a Flutter-based application and learned that it is different from other hybrid frameworks like React Native or…

https://github.com/R00tkitSMM/CVE-2024-27804

Discover the 'Antidot' Android Banking Trojan: a fake Google Play update that steals credentials using overlay attacks and remote control techniques.

Analyze the Blackrock Android malware in Part 7 of the mobile malware series. Learn how it abuses accessibility services and overlays to steal data.

You might find this to be a fitting prologue to my earlier post on Creating and using JVM instances in Android C/C++ applications… and you…

CVE-2024-31974. Contribute to actuator/com.solarized.firedown development by creating an account on GitHub.

Explore how Anatsa distributes Android malware by using PDF and QR code reader decoys to lure victims through the Google Play store.

Developer Deviato has released DroidPPPwn, a port of the PPPwn PS4 exploit to Android phones. It relies on the C++ port of the PPPwn exploit (and therefore is reasonably fast to run). As one...

In this post, we announce the release of a small library for disassembling Dalvik bytecode. This serves as a foundation for building static analysis tooling for Android applications and system services in Rust. Read on for an example graphview application…

Authored by Dexter Shin Many government agencies provide their services online for the convenience of their citizens. Also, if this service could be

At OffensiveCon 2024, the Android Red Team gave a presentation (slides) on finding and exploiting CVE-2023-20938, a use-after-free vulnerability in the Android Binder device driver. This post will provide technical details about this vulnerability and how…

Clobber the world — Endless side effect issue in Safari

We have discovered a vulnerability in Android that allows an attacker with the WRITE_SECURE_SETTINGS permission, which is held by the ADB shell and certain privileged apps, to execute arbitrary code as any app on a device. By doing so, they can read and write…

Learn how to protect your devices against evolving iOS threats.

Intro Welcome fellow antiquarians, after detouring a little bit on the app layer we are back to the native layer. Both parts are very important for Android userland of course. The apps provide intera…

Summary


On April 18, 2024, XLab's threat hunting system detected an ELF file with zero detections on VirusTotal being distributed through two different domains. One of the domains was marked as malicious by three security firms, while the other was recently…