CVE-2019-5281

There is an information leak vulnerability in some Huawei phones, versions earlier than Jackman-L21 8.2.0.155C185R1P2. When a local attacker uses the camera of a smartphone, the attacker can exploit this vulnerability to obtain sensitive information by performing a series of operations...

Information disclosure

There is an information leak vulnerability in some Huawei phones, versions earlier than Jackman-L21 8.2.0.155C185R1P2. When a local attacker uses the camera of a smartphone, the attacker can exploit this vulnerability to obtain sensitive information by performing a series of operations...

CVE-2019-5306

The CVE-2019-5306 FRP bypass affects Huawei P20 smartphones prior to Emily-AL00A 9.0.0.167(C00E81R1P21T8). According to connected sources, when reconfiguring via FRP, an attacker can bypass the activation lock and gain access to the device. Root cause is a bypass in Factory Reset Protection durin...

CVE-2019-5296

Huawei Mate20 smartphones running versions earlier than HMA-AL00C00B175 are affected by an out-of-bounds read due to insufficient input verification. The issue allows an attacker with high privileges to execute specific commands, potentially causing memory reads and a system abnormal state. The v...

CVE-2019-5281

CVE-2019-5281 affects Huawei smartphones (pre-8.2.0.155) with Jackman-L21 variants. Root cause: information leakage when a local attacker uses the device camera, enabling access to sensitive data. Impact per sources: partial confidentiality loss with local access and no indicated integrity/availa...

CVE-2019-5281

There is an information leak vulnerability in some Huawei phones, versions earlier than Jackman-L21 8.2.0.155C185R1P2. When a local attacker uses the camera of a smartphone, the attacker can exploit this vulnerability to obtain sensitive information by performing a series of operations...

Unpatched Flaw in Xiaomi's Built-in Browser App Lets Hackers Spoof URLs

EXCLUSIVE — Beware, if you are using a Xiaomi's Mi or Redmi smartphone, you should immediately update its built-in MI browser or the Mint browser available on Google Play Store for non-Xiaomi Android devices. That's because both web browser apps created by Xiaomi are vulnerable to a critical...

Recovering Smartphone Typing from Microphone Sounds

Yet another side-channel attack on smartphones: "Hearing your touch: A new acoustic side channel on smartphones," by Ilia Shumailov, Laurent Simon, Jeff Yan, and Ross Anderson. Abstract: We present the first acoustic side-channel attack that recovers what users type on the virtual keyboard of the...

Google Will Prompt European Android Users to Select Preferred Default Browser

Google announced some major changes for its Android mobile operating system in October after the European Commission hit the company with a record $5 billion antitrust fine for pre-installing its own apps and services on third-party Android phones. The European Commission accused Google of forcin...

Get, Set, Election, Go: Preparing For The 2019 Elections

Meeting the Expectations of Millions as They Go Online on The Election Day The 2019 General Elections could possibly be the most important Election event ever, in India... As India advances towards the general elections, this year, it will be the world's largest democratic exercise, and the bigge...

Security Advisory - FRP Bypass Vulnerability on Some Huawei Smartphones

There is a Factory Reset Protection FRP bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the FRP function, an attacker can delete the activation lock after a series of operation, As a result, the FRP function is bypassed and the attacker gains...

A Hidden Nest Secure Mic, Facebook's Dead VPN, and More Security News This Week

The 2020 disinformation campaigns have started, DrainerBot is coming for your smartphone's battery, and more security news this week...

Taking Care of Your Personal Online Security (For Paranoids)

By David Balaban We live in a world where anonymity and online privacy are impossible things. Your phone calls can be tapped, smartphone data can be stolen, and even the camera and microphone can be turned on remotely. You can be watched from the satellite, in real time. We all live in the matrix...

Security Advisory - Information Leakage Vulnerability on Some Smartphones

There is an information leak vulnerability in some Huawei phones. When a local attacker use the camera of a smartphone, the attacker can exploit this vulnerability to obtain sensitive information by performing a series of operations. Vulnerability ID: HWPSIRT-2019-01101 This vulnerability has bee...

A vulnerability in V20 PRO L-01J that may cause a crash

Overview V20 PRO L-01J provided by NTT DOCOMO, INC. is an Android smartphone. V20 PRO L-01J contains a flaw in processing connection using Wi-Fi CERTIFIED Passpoint which may result in the device to crash when Poasspoint is enabled. Hiroyuki Harada of Sapporo Gakuin University, Masashi Honma of...

Security Advisory - Authorization Bypass Vulnerability on Some Huawei Smartphone

Some Huawei smart phones have an authorization bypass vulnerability. Due to improper authorization implementation logic, attackers can bypass certain authorization scopes of smart phones by performing specific operations. This vulnerability can be exploited to perform operations beyond the scope ...

Facebook Paid Teens $20 to Install 'Research' App That Collects Private Data

If you are thinking that Facebook is sitting quietly after being forced to remove its Onavo VPN app from Apple's App Store, then you are mistaken. It turns out that Facebook is paying teenagers around $20 a month to use its VPN app that aggressively monitors their smartphone and web activity and...

Bitdefender BOX 2 bootstrap update_setup command execution vulnerability

Summary An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method /api/updatesetup does not perform firmware signature checks atomically, leading to an exploitable race condition TOCTTOU that allows arbitrary execution o...

Security Advisory - Race Condition Vulnerability on Several Smartphones

There is a race condition vulnerability on certain driver of smartphone. An attacker tricks the user into installing a malicious application, which make multiple processes to operate the same variate at the same time. Successful exploit could cause execution of malicious code. Vulnerability ID:...

Police Can't Force You To Unlock Your Phone Using Face or Fingerprint Scan

Can feds force you to unlock your iPhone or Android phone? ..."NO" A Northern California judge has ruled that federal authorities can't force you to unlock your smartphone using your fingerprints or other biometric features such as facial recognition—even with a warrant. The ruling came in the ca...