TGViewer
Channel Public Channel
Android Security & Malware

Android Security & Malware

@androidmalware

Mobile cybersecurity channel
Links: https://linktr.ee/mobilehacker
Contact: mobilehackerofficial@gmail.com
Open in Telegram
Subscribers
44.7K
Photos
136
Videos
22
Links
2.9K

Showing posts older than #2020 · Back to latest

Older Posts 20 shown
Post #2019 8.8K
"The WebP 0day" - a full technical analysis the recently patched vulnerability in the WebP image library that was exploited in the wild (CVE-2023-4863)
https://blog.isosceles.com/the-webp-0day/
Isosceles Blog The WebP 0day Early last week, Google released a new stable update for Chrome. The update included a single security fix that was reported by Apple's Security Engineering and Architecture (SEAR) team. The issue, CVE-2023-4863, was a heap buffer overflow in the WebP image…
  • 🔥 10
  • ❤ 2
  • 👍 2
Post #2016 7.46K
In December 2022, Google discovered in-the-wild exploit chain targeting Samsung Android devices used by commercial mobile spyware vendor Variston.
It appears that n-day exploits that were fixed in Google products in 2022 (Chrome), were not fixed yet in Samsung (Samsung browser) and because of that exploited by espionage software in early exploitation stages.
Final stage, describes how attacker achieved execution as system_server (CVE-2023-0266, CVE-2023-26083)
https://googleprojectzero.blogspot.com/2023/09/analyzing-modern-in-wild-android-exploit.html
projectzero.google Analyzing a Modern In-the-wild Android Exploit By Seth Jenkins, Project ZeroIntroductionIn December 2022, Google’s Threat Analysis Group (...
  • ❤ 11
  • 👍 4
Post #2014 13.4K
Massive Mobile Security Framework (MMSF)
A mobile open-source framework that combines functionalities from frida, objection, drozer, reflutter and more for iOS and Android app analysis
Info: https://securitycafe.ro/2023/09/18/mobile-pentesting-101-introducing-to-mmsf-massive-mobile-security-framework/
Download: https://github.com/St3v3nsS/MMSF
Security Café Mobile Pentesting 101 – Introducing to MMSF (Massive Mobile Security Framework) Massive Mobile Security Framework, or MMSF, is a mobile framework that combines functionalities from Frida, objection, drozer, and many more.
  • 👍 16
Post #2012 9.93K
Android App Pin Security Issue Allows Unauthorized Payments via Google Wallet even with enabled "Require device unlock for NFC" option (CVE-2023-35671)
While in pinned mode, all other apps become temporarily inaccessible, except Google Wallet.
PoC: https://github.com/MrTiz/CVE-2023-35671
GitHub GitHub - MrTiz/CVE-2023-35671: Android App Pin Security Issue Allowing Unauthorized Payments via Google Wallet Android App Pin Security Issue Allowing Unauthorized Payments via Google Wallet - MrTiz/CVE-2023-35671
  • 👍 7
  • 🔥 3
  • 🤔 3
Post #2008 10.3K
New 0-click exploit chain discovered targeting iOS devices delivers Pegasus Spyware
Exploit chain was capable of compromising iPhones (iOS 16.6) without any user interaction.
The device is compromised just by receiving malicious image in iMessage (CVE-2023-41064, CVE-2023-41061).
➡️ Update your iOS devices
https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/
The Citizen Lab BLASTPASS Citizen Lab found an actively exploited zero-click vulnerability being used to deliver NSO Group’s Pegasus mercenary spyware while checking the device of an individual employed by a Washington DC-based civil society organization with international offices. We…
  • 🔥 20
  • 👍 8
  • ❤ 5
  • 😁 2
  • 🤯 1
  • 🏆 1
  • 🆒 1
Post #2007 13.3K
How to spoof iOS devices with Bluetooth pairing messages using Android
https://www.mobile-hacker.com/2023/09/07/spoof-ios-devices-with-bluetooth-pairing-messages-using-android/
Mobile Hacker Spoof iOS devices with Bluetooth pairing messages using Android - Mobile Hacker [update 09.10.2023] In this update, I will share how to extend the signal of Android nRF Connect app that can send pairing messages, demonstrate AppleJuice on the latest iOS 17, show which specific advertisement packet can trigger pop-ups from up to 50 meters…
  • 👍 20
  • 🤣 6
  • ❤ 1
Post #2006 8.45K
Android.Pandora trojans (ancestor of Linux Mirai trojan) compromise Android devices, either during firmware updates or when applications for viewing pirated video content are installed
https://news.drweb.com/show/?i=14743&lng=en
Dr.Web Pandora's box is now open: the well-known Mirai trojan arrives in a new disguise to Android-based TV sets and TV boxes Doctor Web has identified a family of Android.Pandora trojans that compromise Android devices, either during firmware updates or when applications for viewing pirated video content are installed. This backdoor inherited its advanced DDoS-attack capabilities…
  • 👍 12
  • 🤔 1
Post #2001 10.1K
Bypassing Hardened Android Application available on the Play Store
-Root Detection Check in Native Java code and in React Native file
-Emulator Check
-Frida Running Check
-SSL Pinning Bypass
https://notsosecure.com/bypassing-hardened-android-applications
NotSoSecure Bypassing Hardened Android Applications Recently, we performed a penetration test on an Android application available on the Play Store. The app had good security in place to protect it from being opened and executed on a rooted app. In
  • 👍 12
Post #2000 8.36K
Trojanized Signal and Telegram apps were discovered on Google Play and Galaxy Store
Patched Signal is the first documented case of spying on a victim’s Signal communications by secretly autolinking the compromised device to attacker’s Signal device
https://www.welivesecurity.com/en/eset-research/badbazaar-espionage-tool-targets-android-users-trojanized-signal-telegram-apps/
Welivesecurity BadBazaar espionage tool targets Android users via trojanized Signal and Telegram apps ESET research uncovers active campaigns linked to the China-aligned APT group known as GREF that distributing espionage code previously targeting Uyghurs.
  • 👍 11
Older posts →
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →