SMS group spam promises free gifts in return for bill payment

We’re seeing lots of examples of peculiar SMS messages sent to random groups of people. Most of these messages promise free gifts and/or offers after having paid bills. Nobody has asked for these texts, and they’re not being sent by providers of any services. What’s going on? The set up Most of t...

mobile.petite18.com Cross Site Scripting vulnerability OBB-2472571

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-44751

A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website attached with USSD code in JavaScript or iFrame can trigger dialer application from F-Secure browser which can be exploited by an attacker to send unwanted USSD messages or perform unwanted calls. In mos...

IBM Cognos Analytics 安全漏洞

IBM Cognos Analytics is a suite of business intelligence software from IBM Corporation. The software includes reports, dashboards and scorecards, and can help companies adjust their decisions by analyzing key factors and key people, etc. A security vulnerability exists in IBM Cognos Analytics...

Samsung Knox Guard Execution Error Vulnerability

Samsung Knox Guard is a security solution based on the open-source Android platform from South Korea's Samsung Samsung, which can comprehensively enhance security through a combination of physical means and software systems, and is perfectly compatible with the Android and Google ecosystems,...

Samsung SMR 安全漏洞

Samsung SemRewardManager is an application for Samsung Samsung mobile devices. An information disclosure vulnerability exists in Samsung SemRewardManager that stems from improper use of implicit intent in SemRewardManager, which can be exploited by an attacker to access the BSSID...

A week in security (Nov 22 – Nov 28)

Last week on Malwarebytes Labs How to defend your website against card skimmers Security researchers play peek-a-boo with Conti ransomware server Windows 10 chills out, gives sysadmins a break Please dont buy this! 3 gift card scams to watch out for this Black Friday Millions of GoDaddy customer...

Dockerized-Android - A Container-Based Framework To Enable The Integration Of Mobile Components In Security Training Platforms

Dockerized Android is a container-based framework that allows to execute and Android Emulator inside Docker and control it through a browser. This project has been developed in order to provide a starting point for integrating mobile security components into Cyber Ranges but it can be used for an...

Samsung SMR 安全漏洞

Samsung SMR is a system patch package from Samsung South Korea. The patch program is provided for Samsung mobile applications. A security vulnerability exists in Samsung SMR that allows untrusted applications to overwrite certain Bluetooth information...

Android Trojan GriftHorse, the gift horse you definitely should look in the mouth

Researchers at Zimperium have discovered an aggressive mobile premium services campaign with over 10 million victims all over the world. The stolen amount could amass hundreds of millions of Euros. The scam was hidden behind malicious Android apps, and the researchers have named the Trojan...

Securing mobile devices. A timely reminder

While home working might now be the norm for some, more and more people are going back to their place of work on a more regular basis. If you’re commuting again or if you’re responsible for securing your people’s devices it’s a good idea to revisit and review your security admin for mobile device...

CVE-2021-1854

A call termination issue with was addressed with improved logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. A legacy cellular network can automatically answer an incoming call when an ongoing call ends or drops...

Protecting Phones From Pegasus-Like Spyware Attacks

Pegasus spyware from the Israeli firm NSO Group is nearly invisible. It sends messages to compromise targeted phones without setting off any alarm bells to the phone’s user. There’s little you can do to protect yourself, say experts. But little isn’t nothing. Our guest today is Adam Weinberg, whi...

awesome-mobile-security

It is an offensive tool for mobile security research. The repository xynsd/awesome-mobile-security is a curated collection of resources and tools for mobile security research, covering both Android and iOS platforms. It aggregates various references and tools from their respective owners, serving...

CVE-2021-22348

There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause code to execute...

CVE-2021-30507

Inappropriate implementation in Offline in Google Chrome on Android prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page...

Command Execution Vulnerability in China Mobile's Third-Party IPTV Management System

China Mobile is a GSM-based mobile communications operator, and is one of the "Big Three" telecom operators along with China Unicom and China Telecom. A command execution vulnerability exists in the third-party IPTV management system of China Mobile, which can be exploited by attackers to gain...

Qualcomm Chip Bug Opens Android Fans to Eavesdropping

A vulnerability in a 5G modem data service could allow mobile hackers to remotely target Android users by injecting malicious code into a phone’s modem – gaining the ability to execute code, access mobile users’ call histories and text messages, and eavesdrop on phone calls. That’s according to...

Anyone For a Smart Network Slice?

As with any standardization effort, development of 5G specifications accounted for numerous technology trends and new use cases. Network functions were designed for virtualization and automation to enhance operational efficiency and agility. At the same time, smart devices were in the midst of a...

CVE-2021-0427

In parseExclusiveStateAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...