SIM Cards in 29 Countries Vulnerable to Remote Simjacker Attacks

Until now, I'm sure you all might have heard of the SimJacker vulnerability disclosed exactly a month ago that affects a wide range of SIM cards and can remotely be exploited to hack into any mobile phone just by sending a specially crafted binary SMS. If you are unaware, the name "SimJacker" has...

Google Android MNH Mobilization Vulnerability (CNVD-2019-36638)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA in the U.S. MNH driver is one of the MNH drivers. An elevation of privilege vulnerability exists in the MNH driver in Google Android. An attacker can exploit this vulnerability to elevate privilege...

Google Android Media framework remote code execution vulnerability (CNVD-2019-30325)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. A remote code execution vulnerability exists in the Media framework component of Google Android 10. A remote attacker can exploit the vulnerability to execute code...

Information disclosure

A vulnerability in Cisco Webex Meetings Mobile iOS could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data by using an invalid Secure Sockets Layer SSL certificate. The vulnerability is due to insufficient SSL certificate validation by the affected...

FAKE APPS!—courtesy of Agent Smith

As new mobile malware sweeps the globe, here’s how to keep your device secure. We’re spending more and more of our lives online and for most of us the door to this digital world is our smartphone. It’s the first thing we look at when we wake up and the last thing we check at night. It’s where we ...

CVE-2019-9140

When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a...

How to cost-effectively manage and secure a mobile ecosystem

Today’s post was written by Roxane Suau, Vice President of Marketing for Pradeo. In the corporate environment, mobile devices and applications are at the center of communications, enhancing collaborators’ productivity with 24/7 access to information. But at the same time, they represent thousands...

CVE-2018-11819

CVE-2018-11819 is a use-after-free style issue in Qualcomm/ Snapdragon WLAN code caused by handling multiple ACS scan requests concurrently. Affected products span Snapdragon Auto, Snapdragon Consumer IoT, Snapdragon Industrial IoT, and Snapdragon Mobile platforms (e.g., MDM9206, MDM9607, MDM9640...

Mobile Risks Boom in a Post-Perimeter World

Cybercriminals are now taking a mobile-first approach to hacking the enterprise. Case in point, last month a half-billion Apple iOS users were stung by an attack exploiting an unpatched bug in Chrome for iOS. Crooks managed to hijack user session and redirect traffic to malicious websites...

CVE-2017-15841

When HOST sends a Special command ID packet, Controller triggers a RAM Dump and FW reset in Snapdragon Mobile in version SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 835, SnapdragonHighMed2016...

Android Q — Google Adds New Mobile Security and Privacy Features

Google has recently released the first beta version of Android Q, the next upcoming version of Google's popular mobile operating system, with a lot of new privacy improvements and other security enhancements. Android Q, where Q has not yet been named, offers more control over installed apps, thei...

A Mobile App Scanner is Not Just Another App

Mobile applications assist us mightily with our daily tasks. They increase our productivity with anywhere, anytime, high-functioning tools, and they help us communicate and share information with family members, friends, and co-workers. Every day, the rapidly evolving app market brings us more ap...

Threatpost Poll: Over Half of Firms Asked Struggle with Mobile Security

A Threatpost survey of readers found over half of respondents don’t feel sufficiently prepared to prevent or handle a security incident stemming from mobile devices in their firm. The informal survey results should serve as harbinger for security professionals in light of the fact that 80 percent...

Threatpost Poll: Is It Impossible to Secure Mobile Devices?

Between applications and operating systems, a slew of mobile threats continue to pop up – and when it comes to security, it’s getting harder and harder for enterprises to keep up. Just in the past week, Apple patched a massive flaw in its FaceTime allowing a bad actor to eavesdrop on victims; whi...

CVE-2018-5880

The CVE-2018-5880 entry affects Qualcomm Snapdragon devices (mobile and wear) across multiple chips (e.g., MDM9206, MDM9607, SD 210/212/205, 425, 427, 430, 435, 450, 625, 636, 835, SDA660, SDM630, SDM660). The vulnerability stems from an improper data length check when processing an event report ...

Google Play Removes Malicious Malware-Ridden Apps

Google Play has removed two malicious apps that were infecting devices with a notorious banking malware bent on scooping up victim’s credentials. The two apps, Currency Converter and BatterySaverMobo, purported to be useful mobile tools that help users calculate currency and optimize mobile batte...

Google Removes 85 Adware Apps That Infect 9 Million Android Users

Google has removed 85 apps from its Play Store after finding out that they were pushing aggressive, full-screen adware to Android users. With the rise in the mobile market, Adware has become one of the most prevalent mobile threats in the world. Adware has traditionally been used to aggressively...

Information disclosure

Information leak in UIM API debug messages in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 800, ...

CVE-2017-18326

CVE-2017-18326 affects Qualcomm Snapdragon mobile and Snapdragon Wear modem components (e.g., MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/212/205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 800, ...

CVE-2017-18323

CVE-2017-18323 involves cryptographic key material leakage in TDSCDMA RRC debug messages affecting Qualcomm Snapdragon components across multiple platforms (e.g., MDM9206, MDM9607, MDM9615, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU) and various SD/SoC families (e.g., SD 21...