Android Security & Malware

Four Anatsa (also known as TeaBot) Android banking Trojans were discovered on Google Play Store with over 30,000 installs targeting almost 600 financial app
https://www.threatfabric.com/blogs/anatsa-hits-uk-and-dach-with-new-campaign

ThreatFabric

Anatsa banking Trojan hits UK, US and DACH with new campaign

Anatsa returns with a new campaign targeting UK, US and DACH supported by droppers on Google Play Store.

👍14🤔3

7.72K views07:15

Android Security & Malware

Interesting hardening technique of Android financial apps
Put custom permission on their components such as activities, services, etc, so banking Trojans can't launch and interact with them
This prevents malware to perform on device fraudulent transactions
https://debugactiveprocess.medium.com/strengthening-android-security-mitigating-banking-trojan-threats-fe94ae9e2f02

Medium

Strengthening Android Security: Mitigating Banking Trojan Threats

In today’s digital age, mobile devices have become integral to our daily lives, including financial transactions. However, this increased…

👍21❤3

8.49K views09:38

👍 27 👎 2

Android Security & Malware

Android SELinux Internals Part I Understand how Android SELinux works, along with its functionalities and benefits
https://8ksec.io/android-selinux-internals-part-i-8ksec-blogs/

8kSec

Android SELinux Internals Part 1 | 8kSec

Explore Android SELinux internals in Part 1. Learn how SELinux provides mandatory access control on Android devices and discover bypass techniques.

👍19🔥2

9.35K views08:26

👍 32 👎

Android Security & Malware

A modified version of the Telegram Androis app found to be maliciously patched with Triada malware
https://blog.checkpoint.com/security/dont-be-fooled-by-app-earances-check-point-researchers-spot-hidden-malwares-behind-legitimate-looking-apps/

Check Point Blog

Don’t be fooled by app-earances: Check Point Researchers spot hidden malwares behind legitimate looking apps - Check Point Blog

Highlights: A modified version of the popular messaging app Telegram found to be malicious The malicious app can sign up the victim for various paid

👍20🤔4❤1😁1

9.99K views05:09

👍 36 👎

Android Security & Malware

Kunai - library for analyzing Dalvik Executable Files (DEX)
https://farena.in/android/analysis/kunai-lib/

Eduardo Blázquez's Personal Webpage

Kunai, a library for analyzing Dalvik Executable Files

Kunai is a library for analyzing Dalvik Executable Files, this library is written in C++ for performance reasons

👍18🔥1

7.48K views14:16

👍 29 👎 3

Android Security & Malware

Intercepting Android App Traffic using BurpSuite
Video tutorial shows how to setup Android emulator, installing Burp Certificate in the System Store, proxy app traffic through BurpSuite, and bypass certificate pinning using Frida
https://youtu.be/xp8ufidc514

YouTube

Intercepting Android App Traffic with BurpSuite

00:00 - Introduction, talking about RouterSpace and why we can't just do what we did in that video
01:25 - Installing Genymotion, Virtual Box, and ADB; while talking about why I don't use Android Studio/AVD. Simply because genymotion just works.
02:05 - Make…

👍15❤2

8.14K views05:01

👍 21 👎 1

Android Security & Malware

Bringing NFC contactless payment to CASIO F-91W watch
https://medium.com/@matteo.pisani.91/how-i-hacked-casio-f-91w-digital-watch-892bd519bd15

Medium

How I hacked CASIO F-91W digital watch

Bringing NFC contactless payment capability to a true classic.

👍23🤔5🔥1🖕1

7.55K views06:07

👍 25 👎 1

Android Security & Malware

Introduction to Kali NetHunter Hacker series: Which NetHunter fits you best?
https://www.mobile-hacker.com/2023/07/04/introduction-of-kali-nethunter-hacker-series-and-which-nethunter-fits-you-best/

Mobile Hacker

Introduction to Kali NetHunter hacker series and which NetHunter fits you best - Mobile Hacker

Welcome to the exciting world of NetHunter! In this blog post, we will dive into the powerful toolkit designed specifically for mobile penetration testing and ethical hacking. Kali NetHunter brings the full arsenal of Kali Linux tools to your mobile device…

❤16😍3👍2🥰2👏1🤔1

7.79K views13:51

👍 40 👎 3

Android Security & Malware

Analysis of account takeover discovered in Android app with 100M+ installs from Google Play ($1000 bounty)
https://medium.com/@amolbhavar/how-i-get-1000-bounty-for-discovering-account-takeover-in-android-application-3c4f54fbde39

Medium

How I get 1000$ bounty for Discovering Account Takeover in Android Application

In this blog post, I will share my experience of discovering a critical account takeover vulnerability in an Android application which has…

👍17❤3

7.46K views05:12

👍 22 👎 2

Android Security & Malware

Analysis of Android EverSpy 2 Malware which source code price is $4,000
https://www.theobservator.net/everspy-2-malware-reverse-engineering/

Th3 0bservator - Security Researcher and Machine Learning Specialist

EverSpy 2 Malware – Reverse Engineering - Th3 0bservator

Overview "EverSpy 2" is an advanced Android malware targeting South and North America, Europe and Asia with efficiency and high infection rates, designed to be most undetectable as possible and with a tones of features, like: Auto Clicker; Application Injection:…

❤12👍4🤔3🤣3

7.94K views16:16

👍 23 👎

Android Security & Malware

Android ASCWG CTF Challenge
https://0xmkr24.medium.com/android-challenge-in-ascwg-finals-109c03c66055

Medium

Android Challenge in ASCWG Finals

Hello guys, my name is Adham Makroum, I started the Android PenTest app a short time ago, so I saw this challenge as training for me and…

👍18❤1🤔1

8.13K views06:12

👍 29 👎 1

Android Security & Malware

Using MLIR for Dalvik Bytecode Analysis
Using intermediate representations allows analysts to write optimizations and code analysis passes easier than parsing binary or bytecode directly. Kunai is a library intended for static analysis of dalvik bytecode, in a newer version of the library, the idea is to use the capabilities and possibilities offered by MLIR, writing a new dialect centered on Dalvik instructions.
Presentation: https://youtu.be/hfqOivYdD40
Slides: https://llvm.org/devmtg/2023-05/slides/Lightning-Talks/01-Eduardo-EuroLLVM2023.pdf

YouTube

2023 EuroLLVM - Using MLIR for Dalvik Bytecode Analysis

2023 European LLVM Developers' Meeting
https://llvm.org/devmtg/2023-05/
------
Using MLIR for Dalvik Bytecode Analysis
Speaker: Eduardo Blázquez
------
Slides: https://llvm.org/devmtg/2023-05/slides/Lightning-Talks/01-Eduardo-EuroLLVM2023.pdf
-----
Using…

👍14❤3

8.28K views12:12

👍 17 👎

Android Security & Malware

Exploit Google Pixel 7

In detail analysis of exploiting CVE-2023-21400 on Google Pixel 7 with Dirty Pagetable exploit that uses file UAF and pid UAF vulnerabilities
https://yanglingxi1993.github.io/dirty_pagetable/dirty_pagetable.html

👍8❤1

10.7K views10:28

👍 20 👎

Android Security & Malware

Android malware installed directly from a website can bypass "installation from untrusted sources" warning using WebAPK technology
WebAPK enables creation Android native apps from web applications
https://www.linkedin.com/pulse/using-webapk-technology-phishing-attacks-csirt-knf

Using WebAPK Technology for Phishing Attacks

Report: Using WebAPK Technology for Phishing Attacks Introduction The CSIRT KNF team carried out a detailed analysis of a website reported by RIFFSEC (https://twitter.com/getriffsec/status/1676663509617131520).

👍23

7.14K views15:01

👍 23 👎

Android Security & Malware

The Turkish Government Masqueraded Site Distributing Android RAT
https://blog.cyble.com/2023/07/10/the-turkish-government-masqueraded-site-distributing-android-rat/

Cyble

Turkish Gov Site Masquerade Distributes Android RAT

CRIL analyzes the phishing campaign masquerading Turkish Government to distribute Android RAT with VNC and Keylogging feature

👍16❤1🥰1

6.86K views15:51