Beautifying Native Android Code in Ghidra!
We partially native APK, extract the native binaries, and analyze the native ELF binary
https://youtu.be/sK_jsQ5bJUk
We partially native APK, extract the native binaries, and analyze the native ELF binary
https://youtu.be/sK_jsQ5bJUk
YouTube
Beautifying Native Android Code in Ghidra
In this video, we take our partially native APK, extract the native binaries, and analyze the native ELF binary in Ghidra.
---
Timestamps:
00:00 Intro
00:47 Opening up Previous Application
02:51 Defining Methods Natively
05:45 Ghidra Time!
07:10 ELF Header…
---
Timestamps:
00:00 Intro
00:47 Opening up Previous Application
02:51 Defining Methods Natively
05:45 Ghidra Time!
07:10 ELF Header…
👍9❤5🔥1
Operation Triangulation: iOS devices targeted with previously unknown malware
This malware compromised several Kaspersky employees: The target iOS device receives a message via the iMessage service, with an attachment containing an exploit. Without any user interaction, the message triggers a vulnerability that leads to code execution.
https://securelist.com/operation-triangulation/109842/
This malware compromised several Kaspersky employees: The target iOS device receives a message via the iMessage service, with an attachment containing an exploit. Without any user interaction, the message triggers a vulnerability that leads to code execution.
https://securelist.com/operation-triangulation/109842/
👍15🤔5👾3🌭2
CVE-2023-20963: 0-day in Android's Parcel serialization/deserialization which was used in-the-wild by the Pinduoduo app
https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2023/CVE-2023-20963.html
https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2023/CVE-2023-20963.html
❤18👍4👾1
Binder Trace: Tool for intercepting and parsing Android Binder messages Think of it as "Wireshark for Binder"
https://github.com/foundryzero/binder-trace
https://github.com/foundryzero/binder-trace
GitHub
GitHub - foundryzero/binder-trace: Binder Trace is a tool for intercepting and parsing Android Binder messages. Think of it as…
Binder Trace is a tool for intercepting and parsing Android Binder messages. Think of it as "Wireshark for Binder". - foundryzero/binder-trace
👍15❤2
HelloTeacher: New Android Malware Targeting Banking Users In Vietnam
https://blog.cyble.com/2023/06/05/helloteacher-new-android-malware-targeting-banking-users-in-vietnam/
https://blog.cyble.com/2023/06/05/helloteacher-new-android-malware-targeting-banking-users-in-vietnam/
Cyble
HelloTeacher: Android Malware Targets Vietnam Bank Users
Cyble analyzes a new malware "HelloTeacher" masquerading as popular messaging app to target banking users from Vietnam and steals sensitive data.
👍9❤2
iOS Deep Link attacks Part 2 – Exploitation
https://8ksec.io/ios-deep-link-attacks-part-2-exploitation-8ksec-blogs/
https://8ksec.io/ios-deep-link-attacks-part-2-exploitation-8ksec-blogs/
8kSec
iOS Deep Link Attacks Part 2: Exploitation | 8kSec
Explore iOS deep link vulnerabilities with technical exploitation demos in Part 2. Covers URL scheme hijacking and universal link attacks.
👍12
An active Android campaign pushes adware to Android devices with the purpose of driving revenue
https://www.bitdefender.com/blog/labs/tens-of-thousands-of-compromised-android-apps-found-by-bitdefender-anomaly-detection-technology/
https://www.bitdefender.com/blog/labs/tens-of-thousands-of-compromised-android-apps-found-by-bitdefender-anomaly-detection-technology/
Bitdefender
Tens of Thousands of Compromised Android Apps Found by Bitdefender Anomaly Detection Technology
Bitdefender researchers used a recently announced industry-first app anomaly detection technology incorporated into Bitdefender Mobile Security to uncover a hidden malware campaign living undetected on mobile devices worldwide for more than six months.
👍13🤔2😁1
iOS pentesting 101
How to setup iOS environment
https://securitycafe.ro/2023/06/12/mobile-pentesting-101-how-to-set-up-your-ios-environment/
How to setup iOS environment
https://securitycafe.ro/2023/06/12/mobile-pentesting-101-how-to-set-up-your-ios-environment/
Security Café
Mobile Pentesting 101 – How to Set Up Your iOS Environment
As mentioned in the Mobile Pentesting 101 – How to set up your Android Environment article, I am now offering you valuable information regarding the iOS pentesting environment. This will be m…
👍21❤1
Android Security & Malware
Android Malware Analysis of Chameleon banking trojan Part 1: https://n0psn0ps.github.io/2023/03/02/android-malware-analysis-series-ato.apk-part-3.1/ Part 2: https://n0psn0ps.github.io/2023/04/13/android-malware-analysis-series-ato.apk-part-3.2/
Cloud Mining Scam Distributes Roamer Android Banking Trojan
https://blog.cyble.com/2023/06/14/cloud-mining-scam-distributes-roamer-banking-trojan/
https://blog.cyble.com/2023/06/14/cloud-mining-scam-distributes-roamer-banking-trojan/
👍7
Discovered Android GravityRAT malware being distributed as the BingeChat and Chatico messaging apps
https://www.welivesecurity.com/2023/06/15/android-gravityrat-goes-after-whatsapp-backups/
https://www.welivesecurity.com/2023/06/15/android-gravityrat-goes-after-whatsapp-backups/
WeLiveSecurity
Android GravityRAT goes after WhatsApp backups
ESET researchers analyzed an updated version of Android GravityRAT spyware that steals WhatsApp backup files and can receive commands to delete files.
👍9❤3🤔3🔥1
Android Malware Impersonates ChatGPT-Themed Applications
https://unit42.paloaltonetworks.com/android-malware-poses-as-chatgpt/
https://unit42.paloaltonetworks.com/android-malware-poses-as-chatgpt/
Unit 42
Android Malware Impersonates ChatGPT-Themed Applications
Android malware posing as ChatGPT-themed apps targets mobile users. We report on instances of this attack vector, identifying two distinct types.
👍12
DoNot APT Elevates its Tactics by Deploying Malicious Android Apps on Google Play Store impersonating VPN apps (iKHfaa VPN and nSure Chat)
https://www.cyfirma.com/outofband/donot-apt-elevates-its-tactics-by-deploying-malicious-android-apps-on-google-play-store/
https://www.cyfirma.com/outofband/donot-apt-elevates-its-tactics-by-deploying-malicious-android-apps-on-google-play-store/
CYFIRMA
DoNot APT Elevates its Tactics by Deploying Malicious Android Apps on Google Play Store - CYFIRMA
EXECUTIVE SUMMARY The team at CYFIRMA recently obtained suspicious Android apps hosted on the Google Play Store under the account...
👍11❤2🤔1
Leveraging Android Permissions: A Solver Approach (CVE-2023-20947)
https://blog.thalium.re/posts/leveraging-android-permissions/
https://blog.thalium.re/posts/leveraging-android-permissions/
THALIUM
Leveraging Android Permissions: A Solver Approach
The Android permission management system has already suffered from several vulnerabilities in the past. Such weaknesses can grant dangerous permissions to a malevolent application, an example being CALL_LOG, which gives access to all incoming and outgoing…
👍10❤1
Analysis of Triangulation iOS spyware implant
https://securelist.com/triangledb-triangulation-implant/110050/
https://securelist.com/triangledb-triangulation-implant/110050/
👍7❤2
Reversing Flutter apps: Dart’s Small Integers
https://cryptax.medium.com/reversing-flutter-apps-darts-small-integers-b922d7fae7d9
https://cryptax.medium.com/reversing-flutter-apps-darts-small-integers-b922d7fae7d9
Medium
Reversing Flutter apps: Dart’s Small Integers
This article delves into the reverse engineering of Dart executable or Flutter release applications. We focus on the reverse engineering of…
👍9❤1
The State of Android (Banking) Malware: Insights from 2022 and Predictions for 2023
https://www.threatfabric.com/hubfs/ThreatFabric_Generic_Report-The%20State%20of%20Android%20Banking%20Malware%202022.pdf
https://www.threatfabric.com/hubfs/ThreatFabric_Generic_Report-The%20State%20of%20Android%20Banking%20Malware%202022.pdf
👍10❤4
Military service members have been receiving physical smartwatches in the mail. Smartwatches can auto-connect to Wifi and began connecting to cell phones unprompted, access voice and cameras
https://www.cid.army.mil/Media/Press-Center/Article-Display/Article/3429159/cid-lookout-unsolicited-smartwatches-received-by-mail/
https://www.cid.army.mil/Media/Press-Center/Article-Display/Article/3429159/cid-lookout-unsolicited-smartwatches-received-by-mail/
👍13🤔1
Reversing Flutter-based Android Malware “Fluhorse”
https://www.fortinet.com/blog/threat-research/fortinet-reverses-flutter-based-android-malware-fluhorse
https://www.fortinet.com/blog/threat-research/fortinet-reverses-flutter-based-android-malware-fluhorse
Fortinet Blog
Fortinet Reverses Flutter-based Android Malware “Fluhorse”
Gain insights into the Fluhorse malware campaign as we've managed to fully reverse engineer the malicious Flutter applications. Learn more.…
👍15🎉2❤1
How to manually unpack native Android packer called KangaPack
https://cryptax.medium.com/inside-kangapack-the-kangaroo-packer-with-native-decryption-3e7e054679c4
https://cryptax.medium.com/inside-kangapack-the-kangaroo-packer-with-native-decryption-3e7e054679c4
Medium
Inside KangaPack: the Kangaroo packer with native decryption
In this blog post, we unpack a malicious sample sha256: 2c05efa757744cb01346fe6b39e9ef8ea2582d27481a441eb885c5c4dcd2b65b . The core…
👍11❤3
Four Anatsa (also known as TeaBot) Android banking Trojans were discovered on Google Play Store with over 30,000 installs targeting almost 600 financial app
https://www.threatfabric.com/blogs/anatsa-hits-uk-and-dach-with-new-campaign
https://www.threatfabric.com/blogs/anatsa-hits-uk-and-dach-with-new-campaign
ThreatFabric
Anatsa banking Trojan hits UK, US and DACH with new campaign
Anatsa returns with a new campaign targeting UK, US and DACH supported by droppers on Google Play Store.
👍14🤔3