UC Browser - the 4th largest mobile browser exfiltrates usersβ data even in Incognito mode
https://hookgab.medium.com/ucbrowser-privacy-study-ecff96fbcee4
https://hookgab.medium.com/ucbrowser-privacy-study-ecff96fbcee4
Medium
UCBrowser privacy study
Full browser history leakage
Mockups of Popular Android Apps Spread Teabot and Flubot Malware
https://labs.bitdefender.com/2021/06/threat-actors-use-mockups-of-popular-apps-to-spread-teabot-and-flubot-malware-on-android/
https://labs.bitdefender.com/2021/06/threat-actors-use-mockups-of-popular-apps-to-spread-teabot-and-flubot-malware-on-android/
Bitdefender Labs
Daily source of cyber-threat information. Established 2001.
Persistent Arbitrary code execution in Mattermost Android app
https://hackerone.com/reports/1115864
https://hackerone.com/reports/1115864
HackerOne
Mattermost disclosed on HackerOne: Persistant Arbitrary code...
## Summary:
Activity `com.mattermost.share.ShareActivity` is is exported and is designed to allow file sharing from third party application to mattermost android app.
```
<activity...
Activity `com.mattermost.share.ShareActivity` is is exported and is designed to allow file sharing from third party application to mattermost android app.
```
<activity...
How to exploit insecure WebResourceResponse configurations + an example vulnerability in Amazon apps
https://blog.oversecured.com/Android-Exploring-vulnerabilities-in-WebResourceResponse/
https://blog.oversecured.com/Android-Exploring-vulnerabilities-in-WebResourceResponse/
News, Techniques & Guides
Android: Exploring vulnerabilities in WebResourceResponse
When it comes to vulnerabilities in WebViews, we often overlook the incorrect implementation of
OnePlus - Elevated package privileges
https://bugs.chromium.org/p/apvi/issues/detail?id=46&q=&can=1
https://bugs.chromium.org/p/apvi/issues/detail?id=46&q=&can=1
Key aspects of secure networking on iOS
https://www.securing.pl/en/key-aspects-of-secure-networking-on-ios/
https://www.securing.pl/en/key-aspects-of-secure-networking-on-ios/
Securing
Key aspects of secure networking on iOS - Securing
More and more developers have become aware of the need for secure networking. However, we still see programs that use unencrypted HTTP on occasion. This article is all about secure networking on iOS.
Forwarded from The Bug Bounty Hunter
Getting started with Android Application Security
https://blog.cobalt.io/getting-started-with-android-application-security-6f20b76d795b
https://blog.cobalt.io/getting-started-with-android-application-security-6f20b76d795b
Two weeks of securing Samsung devices: Part 1
https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1/
https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1/
Oversecured
Two weeks of securing Samsung devices: Part 1 | Oversecured Blog
After spending two weeks looking for security bugs in the pre-installed apps on Samsung devices, we were able to find multiple dangerous vulnerabilities. In this blog, we will be going over them.
Mistune - remote exploit targeting iOS 14.2 on iPhone 11 triggered by opening a malicious link
https://blog.chichou.me/mistune/
https://blog.chichou.me/mistune/
Mistune Bug
Mistune is a remote exploit demostrated at TianfuCup 2020. It consists of two bugs that were introduced by iOS 3 and iOS 6 respectively
iOS Malicious Bit Hunter - malicious plug-in detection engine for iOS applications
https://github.com/alipay/ios-malicious-bithunter
https://github.com/alipay/ios-malicious-bithunter
GitHub
GitHub - alipay/ios-malicious-bithunter: iOS Malicious Bit Hunter is a malicious plug-in detection engine for iOS applications.β¦
iOS Malicious Bit Hunter is a malicious plug-in detection engine for iOS applications. It can analyze the head of the macho file of the injected dylib dynamic library based on runtime. If you are i...
Culpritware - apps which make profit from victims through deceiving, threatening or other criminal actions
https://arxiv.org/pdf/2106.05756.pdf
https://arxiv.org/pdf/2106.05756.pdf
Android screen lock protection thwarted by Facebook Messenger Rooms exploit
https://portswigger.net/daily-swig/android-screen-lock-protection-thwarted-by-facebook-messenger-rooms-exploit
https://portswigger.net/daily-swig/android-screen-lock-protection-thwarted-by-facebook-messenger-rooms-exploit
portswigger.net
Web Application Security, Testing, & Scanning - PortSwigger
PortSwigger offers tools for web application security, testing, & scanning. Choose from a range of security tools, & identify the very latest vulnerabilities.
Apple Issues Urgent Patches for 2 Zero-Day Flaws Exploited in the Wild (CVE-2021-30761, CVE-2021-30762)
https://thehackernews.com/2021/06/apple-issues-urgent-patches-for-2-zero.html
https://thehackernews.com/2021/06/apple-issues-urgent-patches-for-2-zero.html
The Hacker News
Apple Issues Urgent Patches for 2 Zero-Day Flaws Exploited in the Wild
Appleβ βreleases emergency patches for two zero-day vulnerabilities found in the wild
Unpacking Android Apps via a Hardware-Assisted Approach
https://yajin.org/papers/sp21_happer.pdf
https://yajin.org/papers/sp21_happer.pdf
Analysis of bypassing Android Verified Boot process on the Peloton Bike+
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/a-new-program-for-your-peloton-whether-you-like-it-or-not/
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/a-new-program-for-your-peloton-whether-you-like-it-or-not/
McAfee Blog
A New Program for Your Peloton β Whether You Like It or Not | McAfee Blog
Executive Summary The McAfee Advanced Threat Research team (ATR) is committed to uncovering security issues in both software and hardware to help
Google fixes a persistent code execution in their app
https://blog.oversecured.com/Why-dynamic-code-loading-could-be-dangerous-for-your-apps-a-Google-example/
https://blog.oversecured.com/Why-dynamic-code-loading-could-be-dangerous-for-your-apps-a-Google-example/
Oversecured
Why dynamic code loading could be dangerous for your apps: a Google example | Oversecured Blog
Almost every Android app dynamically loads code from native .so libraries or .dex files. There are also some special libraries like Google Play Core to simplify this process. text
Forwarded from The Bug Bounty Hunter
iOS App Testing Through Burp on Corellium
https://defparam.medium.com/ios-app-testing-through-burp-on-corellium-fe59ed849516
https://defparam.medium.com/ios-app-testing-through-burp-on-corellium-fe59ed849516
Medium
iOS App Testing Through Burp on Corellium
Introduction
Forwarded from The Bug Bounty Hunter
Quick Analysis for the SSID Format String Bug
https://blog.chichou.me/2021/06/20/quick-analysis-wifid/
https://blog.chichou.me/2021/06/20/quick-analysis-wifid/
codecolor.ist
CodeColorist
Personal notes