PT-2018-18884

Name of the Vulnerable Software and Affected Versions Samsung mobile devices with N7.x software Description The issue arises from faulty validation of a package signature and package name, allowing attackers to install an arbitrary APK in the Secure Folder SD Card area. Recommendations For Samsun...

Adhrit - Android APK Reversing And Analysis Tool That Can Help Secuity Researchers And CTF Enthusiasts Alike

Adhrit is an open source Android APK reversing and analysis tool that can help security researchers and CTF enthusiasts alike. The tool is an effort to cut down on the amount of time spent on reversing and basic reconnaissance of Android applications. The project is still under progress and will...

LeakVM - Research & Pentesting Framework For Android, Run Security Tests Instantly

LeakVM: Run security tests instantly. Why LeakVM : LeakVM fast security test on Android, by skipping the time-consuming build pen-testing laboratories, you can test on real devices or virtual devices. LeakVM makes researchers and pen-testers more productive since they can run the test on real tim...

Sophisticated RedDrop Malware Targets Android Phones

A sophisticated strain of mobile malware targeting Android devices can extract sensitive data and audio recordings, run up premium SMS charges and then tries to extort money from victims. According to security firm Wandera the malware, dubbed RedDrop, is being distributed inside 53 Android...

Open Source Static Code Analyser: StaCoAn

StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications. This tool will look for interesting lines in the code which can contain: Hardcoded credentials API keys URL’s of API’s Decryption keys Major coding...

CVE-2014-7952: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The backup mechanism in the adb tool in Android might allow attackers to inject additional applications APKs and execute arbitrary code by leveraging failure to filter application data streams...

Reverse Engineering Android apk Files: Apktool

ApkTool is a tool for reverse engineering 3rd party, closed, binary Android apps. It can decode resources to nearly original form and rebuild them after making some modifications; it makes possible to debug smali code step by step. Also it makes working with app easier because of project-like fil...

SuperBeam Injection Vulnerability

SuperBeam is an application that utilizes WiFi networks for file transfer between cell phones. The program uses QR codes or NFC for pairing and can share multiple file formats. A security vulnerability exists in SuperBeam 4.1.3 and earlier versions, which stems from the program's failure to use...

Advance Android Malware Analysis Framework: Droidefense

Droidefense originally named atom: analysis through observation machine is the codename for android apps/malware analysis/reversing tool. It was built focused on security issues and tricks that malware researcher have on they every day work. For those situations on where the malware has...

Design/Logic Flaw

SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which makes it easier for remote attackers to send crafted files, as demonstrated by APK injection...

CVE-2017-17763

SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which makes it easier for remote attackers to send crafted files, as demonstrated by APK injection...

CVE-2017-17763

SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which makes it easier for remote attackers to send crafted files, as demonstrated by APK injection...

CVE-2017-17763

SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which makes it easier for remote attackers to send crafted files, as demonstrated by APK injection...

CVE-2017-17763

SuperBeam versions up to 4.1.3 are affected when using LAN or WiFi Direct Share. The issue is that file transfers do not use HTTPS or any integrity-protection mechanism, enabling a remote attacker to send crafted files (e.g., via APK injection). Affected component: the LAN/WiFi Direct sharing cha...

CVE-2017-17763

SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which makes it easier for remote attackers to send crafted files, as demonstrated by APK injection...

CVE-2017-17763: Missing Encryption of Sensitive Data

SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which makes it easier for remote attackers to send crafted files, as demonstrated by APK injection...

PT-2017-14990

Name of the Vulnerable Software and Affected Versions SuperBeam versions prior to 4.1.4 Description The issue concerns the lack of HTTPS or any integrity-protection mechanism for file transfer when using the LAN or WiFi Direct Share feature. This makes it easier for remote attackers to send craft...

New Android vulnerability allows attackers to modify apps without affecting their signatures(CVE-2017-13156)

A serious vulnerability CVE-2017-13156 in Android allows attackers to modify the code in applications without affecting their signatures. The root of the problem is that a file can be a valid APK file and a valid DEX file at the same time. We have named it the Janus vulnerability, after the Roman...

Android Flaw Lets Hackers Inject Malware Into Apps Without Altering Signatures

Millions of Android devices are at serious risk of a newly disclosed critical vulnerability that allows attackers to secretly overwrite legitimate applications installed on your smartphone with their malicious versions. Dubbed Janus, the vulnerability allows attackers to modify the code of Androi...

Android Flaw Allows Attackers to Poison Signed Apps with Malicious Code

Among the four dozen vulnerabilities Google patched this week was a fix for a bug that allowed attackers to inject malicious code into Android apps without affecting an app’s signature verification certificate. The technique allows an attacker to circumvent device anti-malware protection and...