Android Security & Malware

PoC exploit for CVE-2023-41993 where web content may lead to arbitrary code execution affecting iOS before 16.7
https://github.com/po6ix/POC-for-CVE-2023-41993

An analysis of an in-the-wild iOS Safari WebContent to GPU Process exploit
https://googleprojectzero.blogspot.com/2023/10/an-analysis-of-an-in-the-wild-ios-safari-sandbox-escape.html

How to detect Wi-Fi deauthentication attack and even receive notification on your smartphone
https://www.mobile-hacker.com/2023/10/12/detect-wi-fi-deauthentication-attack-using-esp8266-and-receive-notification-on-smartphone/

iOS Pentesting Series
Learn how to work with useful tools and apps such as Frida, Objection, 3uTools, Cydia, Burp, fsmon, fridump, SSL bypass, reFlutter etc.
Part 1: https://kishorbalan.medium.com/start-your-first-ios-application-pentest-with-me-part-1-1692311f1902
Part 2: https://kishorbalan.medium.com/ios-pentesting-series-part-2-into-the-battlefield-f17ed2778890
Part 3: https://kishorbalan.medium.com/ios-pentesting-series-part-3-the-ceasefire-53fcea3bbd70

Unmasking the Godfather - Reverse Engineering the Latest Android Banking Trojan
Talk: https://youtu.be/jNQmc2REwFg
Slides: https://github.com/LaurieWired/StrangeLoop

Well explained blog on how to find and exploit XSS in Android apps in WebViews and Deep Links
https://securityboulevard.com/2023/10/execution-of-arbitrary-javascript-in-android-application/

Get external IP address of the user during Telegram call. Now it works well and returns public instead of local IP
https://twitter.com/androidmalware2/status/1711313647576686621

Trigger iOS proximity paring messages from over 50 meters using Android phone
The update of the blog explains how to boost transmitted signal from Android nRF Connect app, demonstrates running AppleJuice on iOS17 and using cheap Arduino ESP32 board
https://www.mobile-hacker.com/2023/09/07/spoof-ios-devices-with-bluetooth-pairing-messages-using-android/

NetHunter Hacker IX: How to use MANA Toolkit to create Wi-Fi rogue access point and intercept HTTP traffic
https://www.mobile-hacker.com/2023/10/05/nethunter-hacker-ix-use-mana-toolkit-to-create-wi-fi-rogue-access-point-and-intercept-traffic/

BADBOX: a firmware backdoored trojan found in 74,000 Chinese Android phones, tablets, and TV boxes in 227 counties and territories
There are confirmed 8 devices with backdoors installed — seven TV boxes, the T95, T95Z, T95MAX, X88, Q9, X12PLUS, and MXQ Pro 5G, and a tablet J5-W.
BADBOX functionality:
-Ad Fraud,
-Uses backdoored devices as proxy,
-Create fake accounts,
-Downloads and runs additional modules.
Report: https://www.humansecurity.com/hubfs/HUMAN_Report_BADBOX-and-PEACHPIT.pdf

Analysis of LightSpy mAPT Mobile Payment System Attack attributed to APT-41 group
https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack

Android banking trojan Zanubis, first appeared around August 2022, targeting financial institution and cryptocurrency exchange users in Peru
Zanubis’s main infection path is through impersonating legitimate Peruvian Android applications and then tricking the user into enabling the Accessibility permissions in order to take full control of the device
https://securelist.com/crimeware-report-asmcrypt-loader-lumma-stealer-zanubis-banker/110512/

Use silent SMS messages to track LTE users’ locations
https://mandomat.github.io/2023-09-21-localization-with-silent-SMS/

iOS 15 Image Forensics Analysis and Tools Comparison - Processing details and general device information
https://blog.digital-forensics.it/2023/09/ios-15-image-forensics-analysis-and.html

How it is possible to get persistent reverse shell from Android app without visible permissions to make device unusable via annoying DoS
https://www.mobile-hacker.com/2023/09/27/get-persistent-reverse-shell-from-android-app-without-visible-permissions-to-make-device-unusable/

NVIDIA GeForce Now for Android contains a vulnerability where a malicious application on the same device can process the implicit intent meant for the streamer component. A successful exploit of this vulnerability may lead to limited information disclosure, denial of service, and code execution (CVE‑2023‑31014)
https://nvidia.custhelp.com/app/answers/detail/a_id/5476

EvilBamboo Targets Mobile Devices in Multi-year Campaign
https://www.volexity.com/blog/2023/09/22/evilbamboo-targets-mobile-devices-in-multi-year-campaign/

Android Xenomorph Malware Strikes Again: Over 30+ US Banks Now Targeted
https://www.threatfabric.com/blogs/xenomorph

Working solution on how to inject system CA certificates in Android 14
https://httptoolkit.com/blog/android-14-install-system-ca-certificate/

0-days exploited by Predator spyware were delivered via man-in-the-middle (MITM) attack and 0-click vulnerability against iOS and Android
https://blog.google/threat-analysis-group/0-days-exploited-by-commercial-surveillance-vendor-in-egypt/