#mobilesecurity — Public Fediverse posts

CVE-2026-28576 (CVSS 10) is a SQL injection in the Android Contacts Provider. A public PoC dumps all contacts with no permissions. Patch Android 17 now.

#CVE202628576 #Android #SQLInjection #Android17 #ContactsProvider #MobileSecurity #InfoSec #DataLeak #ExploitPoC #Pixel

https://securityonline.info/cve-2026-28576-android-contacts-sqli/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-28576 (CVSS 10) is a SQL injection in the Android Contacts Provider. A public PoC dumps all contacts with no permissions. Patch Android 17 now.

#CVE202628576 #Android #SQLInjection #Android17 #ContactsProvider #MobileSecurity #InfoSec #DataLeak #ExploitPoC #Pixel

https://securityonline.info/cve-2026-28576-android-contacts-sqli/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-28576 (CVSS 10) is a SQL injection in the Android Contacts Provider. A public PoC dumps all contacts with no permissions. Patch Android 17 now.

#CVE202628576 #Android #SQLInjection #Android17 #ContactsProvider #MobileSecurity #InfoSec #DataLeak #ExploitPoC #Pixel

https://securityonline.info/cve-2026-28576-android-contacts-sqli/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-28576 (CVSS 10) is a SQL injection in the Android Contacts Provider. A public PoC dumps all contacts with no permissions. Patch Android 17 now.

#CVE202628576 #Android #SQLInjection #Android17 #ContactsProvider #MobileSecurity #InfoSec #DataLeak #ExploitPoC #Pixel

https://securityonline.info/cve-2026-28576-android-contacts-sqli/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-28576 (CVSS 10) is a SQL injection in the Android Contacts Provider. A public PoC dumps all contacts with no permissions. Patch Android 17 now.

#CVE202628576 #Android #SQLInjection #Android17 #ContactsProvider #MobileSecurity #InfoSec #DataLeak #ExploitPoC #Pixel

https://securityonline.info/cve-2026-28576-android-contacts-sqli/?utm_source=mastodon&utm_medium=jetpack_social

Android Malware Mantax Otax Encrypts Devices, Steals Data, and Harasses Victims

Beware of Mantax Otax, a sneaky Android malware that's encrypting devices, swiping sensitive data, and even harassing victims - all thanks to clever tricks by Indonesian operators who are using sideloaded APKs to spread the threat.

https://osintsights.com/android-malware-mantax-otax-encrypts-devices-steals-data-and-harasses-victims?utm_source=mastodon&utm_medium=social

#AndroidMalware #MantaxOtax #EmergingThreats #MobileSecurity #MalwareOperations

Bedtime Bug Hunting at BSides Belfast 🐛

A magic-link login, one badly timed Back button and a very unexpected result.

No fancy tools—just curiosity, testing assumptions and thinking like a real user.

Thanks to everyone who came along and to the BSides Belfast team. Recording coming soon.

https://bsidesbelfast.org/schedule/

#BSidesBelfast #CyberSecurity #AppSec #MobileSecurity #ResponsibleDisclosure

Bedtime Bug Hunting at BSides Belfast 🐛

A magic-link login, one badly timed Back button and a very unexpected result.

No fancy tools—just curiosity, testing assumptions and thinking like a real user.

Thanks to everyone who came along and to the BSides Belfast team. Recording coming soon.

https://bsidesbelfast.org/schedule/

#BSidesBelfast #CyberSecurity #AppSec #MobileSecurity #ResponsibleDisclosure

Bedtime Bug Hunting at BSides Belfast 🐛

A magic-link login, one badly timed Back button and a very unexpected result.

No fancy tools—just curiosity, testing assumptions and thinking like a real user.

Thanks to everyone who came along and to the BSides Belfast team. Recording coming soon.

https://bsidesbelfast.org/schedule/

#BSidesBelfast #CyberSecurity #AppSec #MobileSecurity #ResponsibleDisclosure

Bedtime Bug Hunting at BSides Belfast 🐛

A magic-link login, one badly timed Back button and a very unexpected result.

No fancy tools—just curiosity, testing assumptions and thinking like a real user.

Thanks to everyone who came along and to the BSides Belfast team. Recording coming soon.

https://bsidesbelfast.org/schedule/

#BSidesBelfast #CyberSecurity #AppSec #MobileSecurity #ResponsibleDisclosure

Bedtime Bug Hunting at BSides Belfast 🐛

A magic-link login, one badly timed Back button and a very unexpected result.

No fancy tools—just curiosity, testing assumptions and thinking like a real user.

Thanks to everyone who came along and to the BSides Belfast team. Recording coming soon.

https://bsidesbelfast.org/schedule/

#BSidesBelfast #CyberSecurity #AppSec #MobileSecurity #ResponsibleDisclosure

Google Play Exposed to Deceptive App Abuse

A sneaky app, "Vice Streets: Open World", racked up over 1 million downloads on Google Play without a single public review or rating, taking advantage of the platform's Early Access feature. This feature, meant to help developers gather feedback, can also shield them from criticism - and warn signs - that might scare off users.

https://osintsights.com/google-play-exposed-to-deceptive-app-abuse?utm_source=mastodon&utm_medium=social

#DeceptiveApp #GooglePlay #MobileSecurity #EmergingThreats #AppAbuse

Gigabud Trojan Exploits Android Work Profiles to Evade Banking App Malware Checks

The sneaky Gigabud Trojan is exploiting Android work profiles to slip past banking app security checks, allowing it to secretly tamper with transactions and drain accounts. By creating a separate work profile, Gigabud can hide in plain sight and facilitate fraudulent payments that appear legitimate.

https://osintsights.com/gigabud-trojan-exploits-android-work-profiles-to-evade-banking-app-malware-check?utm_source=mastodon&utm_medium=social

#AndroidBankingMalware #GigabudTrojan #RemoteAccessTrojan #Indonesia #MobileSecurity

MantaxOtax Malware Targets Android Devices with Ransomware and Spyware

Meet MantaxOtax, a sneaky malware that's putting Android users on high alert with its potent mix of ransomware and spyware, allowing hackers to hold your device hostage and snoop on your personal life. This hybrid threat can encrypt your files, track your location, and even siphon off sensitive info like contacts, call logs, and…

https://osintsights.com/mantaxotax-malware-targets-android-devices-with-ransomware-and-spyware?utm_source=mastodon&utm_medium=social

#AndroidMalware #Ransomware #Spyware #EmergingThreats #MobileSecurity

A real case: why response speed to a security report reflects company culture

Recently my team ran a security research project on several popular dating apps using reverse engineering. The goal wasn't to cause harm, but to check how well real user data is protected in products used by millions of people daily.

Results varied a lot. Two apps showed no critical issues. The third one told a different story: unencrypted local storage of auth tokens, premium status verified client-side instead of server-side, and a few other issues that together open the door to abuse.

We sent a responsible disclosure report to the app's developers on the 17th, and published a detailed writeup here the same day.

Seven days of silence. Today, the 24th, we finally got a response, first a formal note that the report was forwarded to the technical team.

A bit later the same day, a second message arrived. The company thanked us for the work and confirmed that most of the reported vulnerabilities are already being addressed.

Good to see the report wasn't ignored and the issues were acknowledged. Still, seven days for an initial response to a security issue like this is too long.

Compare that to how we operate. When a bug or vulnerability report reaches our team, the response happens within hours: analysis, fix, surface-level testing, thorough testing, and a new build submitted to the store the same day.

The difference isn't about resources. It's about a culture of accountability.

Full technical breakdown is in a separate post from the 17th on my profile, for anyone curious about the details.

#CyberSecurity #ResponsibleDisclosure #MobileSecurity #InfoSec #TechEthics

#virgroup

Spent about two hours doing reverse engineering on an app with 5M+ downloads, just to check how other devs handle security compared to my own products.

Found 6 real vulnerabilities, some critical. Client-side premium status checks, trusted user certs in a production build, a secret key baked right into the compiled code - the kind of stuff that should get caught in code review.

Reported everything privately to the dev team, no pressure, no public disclosure. Not naming the app - the point isn't to call anyone out, it's that even apps with millions of users ship basic security mistakes.

Good reminder to keep auditing my own stuff too. Security isn't a checkbox, it's a habit.

#AppSecurity #ReverseEngineering #MobileSecurity #InfoSec #AndroidDev #ResponsibleDisclosure #CyberSecurity

Android May Soon Restrict On-Device ADB

https://kitsumed.github.io/blog/posts/android-may-soon-restrict-on-device-adb/

Comments: https://news.ycombinator.com/item?id=49045159

#HackerNews #Android #ADB #Restrictions #MobileSecurity #TechNews #DeveloperUpdates

Fileless RCE on stock Android (~2.5B devices). Reported to Google VRP, confirmed by their own engineering team, closed as NSBC anyway.

Full writeup:
https://www.researchgate.net/publication/407433163_Fileless_Code_Execution_via_Semantic_Gap_in_Android_WebView_Bridge_Architecture_A_Case_Study_in_Platform_Security_Boundary_Ambiguity

#AndroidSecurity #infosec #Android #MobileSecurity #VulnerabilityResearch #RCE #BugBounty #VRP #ResponsibleDisclosure #AppSec #ThreatIntel #WebView #ZeroDay #CVE

Fileless RCE on stock Android (~2.5B devices). Reported to Google VRP, confirmed by their own engineering team, closed as NSBC anyway.

Full writeup:
https://www.researchgate.net/publication/407433163_Fileless_Code_Execution_via_Semantic_Gap_in_Android_WebView_Bridge_Architecture_A_Case_Study_in_Platform_Security_Boundary_Ambiguity

#AndroidSecurity #infosec #Android #MobileSecurity #VulnerabilityResearch #RCE #BugBounty #VRP #ResponsibleDisclosure #AppSec #ThreatIntel #WebView #ZeroDay #CVE

Stolen phones - and specifically iPhones - have robust anti-theft protections. They are worthless once they're flagged - locked to their owner. So why are millions still being stolen every year?
In this paper, we uncover a thriving underground marketplace focused on unlocking stolen phones. It is powered by:

Lookalike domains impersonating Apple, Xiaomi, Samsung and other brands
Smishing campaigns targeting device owners
Pay‑as‑you‑go “unlocking” tools sold on Telegram
By pivoting on DNS data, we identified 10,000+ malicious domains and a growing ecosystem turning locked devices into profit at scale.

👉 Read how this supply chain works—from theft to resale—and why it’s growing fast. https://www.infoblox.com/blog/threat-intelligence/lookalike-domains-expose-the-iphone-theft-economy/

#ThreatIntel #CyberSecurity #Phishing #MobileSecurity #iOS #Smishing #dns #threatintelligence #cybercrime #infosec #infoblox #infobloxthreatintel #threatintelligence #cybercrime  #infosec #infoblox #infobloxthreatintel

Greek police arrested scammers using a fake cell tower for SMS phishing.

Phones were forced onto insecure 2G networks to harvest data and send bank-themed smishing.

https://www.technadu.com/greek-police-arrest-scammers-in-athens-using-fake-cell-tower-for-sms-phishing-operation/618856/

Thoughts?

#Smishing #MobileSecurity #InfoSec

CISA Lays Out Roadmap for CVE Program’s ‘Quality Era’ – Source: securityboulevard.com https://ciso2ciso.com/cisa-lays-out-roadmap-for-cve-programs-quality-era-source-securityboulevard-com/ #SecurityBoulevard(Original) #rssfeedpostgeneratorecho #ThreatIntelligence #CyberSecurityNews #SecurityAwareness #SecurityBoulevard #NetworkSecurity #Risk&Compliance #vulnerabilities #MobileSecurity #SocialFacebook #SocialLinkedIn #Cybersecurity #datasecurity #DataPrivacy #CVEprogram #Governance #Spotlight

U.S. Rep Proposes Cyber Privateers to Fight Foreign Cyberthreats – Source: securityboulevard.com https://ciso2ciso.com/u-s-rep-proposes-cyber-privateers-to-fight-foreign-cyberthreats-source-securityboulevard-com/ #SecurityBoulevard(Original) #rssfeedpostgeneratorecho #NationStateBadActors #PigButcheringScams #CyberSecurityNews #SecurityAwareness #SecurityBoulevard #IncidentResponse #Threats&Breaches #NetworkSecurity #cyberscamfarms #MobileSecurity #SocialFacebook #SocialLinkedIn #CloudSecurity

20-year-old Scattered Spider Member Sentenced to 10 Years in Prison – Source: securityboulevard.com https://ciso2ciso.com/20-year-old-scattered-spider-member-sentenced-to-10-years-in-prison-source-securityboulevard-com/ #SecurityBoulevard(Original) #rssfeedpostgeneratorecho #ThreatIntelligence #CyberSecurityNews #SecurityAwareness #SecurityBoulevard #socialengineering #DigitalCurrency #Identity&Access #NetworkSecurity #ScatteredSpider #MobileSecurity #prisonsentence #SocialFacebook #datasecurity

Tea App Data Breach Fallout: A New App with Security Flaws and Lawsuits – Source: securityboulevard.com https://ciso2ciso.com/tea-app-data-breach-fallout-a-new-app-with-security-flaws-and-lawsuits-source-securityboulevard-com/ #SecurityBoulevard(Original) #rssfeedpostgeneratorecho #classactionlawsuit #CyberSecurityNews #SecurityBoulevard #Threats&Breaches #Identity&Access #NetworkSecurity #Apple.AppStore #MobileSecurity #SocialFacebook #SocialLinkedIn #CloudSecurity #Cybersecurity #securityflaws

Tea App Data Breach Deepens, with 1.1 Million User Chats Exposed – Source: securityboulevard.com https://ciso2ciso.com/tea-app-data-breach-deepens-with-1-1-million-user-chats-exposed-source-securityboulevard-com/ #SecurityBoulevard(Original) #rssfeedpostgeneratorecho #Datasecurityandprivacy #CyberSecurityNews #IndustrySpotlight #SecurityBoulevard #Threats&Breaches #Identity&Access #NetworkSecurity #MobileSecurity #SocialFacebook #SocialLinkedIn #CloudSecurity #Cybersecurity #datasecurity #News

U.S. Woman Sentenced to 8.5 Years for Role in North Korean Worker Scam – Source: securityboulevard.com https://ciso2ciso.com/u-s-woman-sentenced-to-8-5-years-for-role-in-north-korean-worker-scam-source-securityboulevard-com/ #SecurityBoulevard(Original) #DepartmentofJustice(DOJ) #rssfeedpostgeneratorecho #NorthKoreaITworkerscam #CyberSecurityNews #SecurityAwareness #SecurityBoulevard #Identity&Access #NetworkSecurity #MobileSecurity #SocialFacebook #SocialLinkedIn #CloudSecurity #Cybersecurity