A Feminist Take on Information Privacy

Maria Farrell has a really interesting framing of information/device privacy: What our smartphones and relationship abusers share is that they both exert power over us in a world shaped to tip the balance in their favour, and they both work really, really hard to obscure this fact and keep us...

Security Advisory - Race Condition Vulnerability on Several Smartphones

There is a race condition vulnerability on certain detection module of smartphone. The system does not lock certain function properly, when the function is called by multiple processes could cause out of bound write. An attacker tricks the user into installing a malicious application, successful...

Multiple Huawei Product Version Downgrade Vulnerabilities (CNVD-2019-30711)

Huawei P30 and others are products of Huawei, a Chinese company.Huawei P30 is a smartphone.Huawei P30 Pro is a smartphone.Huawei HiSuite is a cell phone assistant application for PCs.Huawei P30 Pro is a smartphone.Huawei P30 Pro is a smartphone.Huawei P30 Pro is a smartphone.Huawei P30 Pro is a...

Security Advisory - Brute Forcing Encrypted Backup Data Vulnerability on Huawei Smartphones

There is a vulnerability that Huawei smartphone user backup information can be obtained by brute forcing the password for encrypting the backup. Vulnerability ID: HWPSIRT-2019-08102 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2019-5263. Huawei has...

Thumbnails of files leaked via Android content provider (NC-SA-2019-007)

If an attacker has physical access to an Android smartphone without a screen lock, but with nextcloud installed and set up, he can easily access the nextcloud-files even if the nextcloud app is locked with a fingerprint or pin...

Bypass lock protection in Android app (NC-SA-2019-008)

If an attacker has physical access to an Android smartphone without a screen lock, but with nextcloud installed and set up, they can circumvent the passcode protection by repeatedly opening and closing the app in a very short time...

On the IoT road: perks, benefits and security of moving smartly

Kaspersky has repeatedly investigated security issues related to IoT technologies for instance, here, or here. Earlier this year our experts have even gained foothold in the security of biomechanical prosthetic devices. The same implies to smart car security: our own research has indicated that...

Huawei Honor Magic 2 Information Disclosure Vulnerability

Huawei Honor Magic 2 is a smartphone from Chinese company Huawei Huawei. An information disclosure vulnerability exists in the secure keyboard feature in previous versions of the Huawei Honor Magic 2 Tony-AL00B 9.1.0.216C00E214R2P1, which stems from the program's failure to properly restrict syst...

Spanish Soccer League App Spies on Fans

The Spanish Soccer League's smartphone app spies on fans in order to find bars that are illegally streaming its games. The app listens with the microphone for the broadcasts, and then uses geolocation to figure out where the phone is. The Spanish data protection agency has ordered the league to...

9 risky apps that you need to monitor on your kids’ smartphone

By Owais Sultan Parents should know if their under 18 child has these apps on their smartphone - No underage child should use these apps. Apart from being a great invention, smartphones are also taken as a most apt tool for killing time. Kids between the age of 11-19 spend 90 percent of their tim...

CVE-2019-5216

There is a race condition vulnerability on Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.156C00E156R2P14T8, Honor 10 smartphones versions earlier than Columbia-AL10B 9.0.0.156C00E156R1P20T8 and Honor Play smartphones versions earlier than Cornell-AL00A...

Information disclosure

There is an information leak vulnerability in some Huawei phones, versions earlier than Jackman-L21 8.2.0.155C185R1P2. When a local attacker uses the camera of a smartphone, the attacker can exploit this vulnerability to obtain sensitive information by performing a series of operations...

CVE-2019-5281

There is an information leak vulnerability in some Huawei phones, versions earlier than Jackman-L21 8.2.0.155C185R1P2. When a local attacker uses the camera of a smartphone, the attacker can exploit this vulnerability to obtain sensitive information by performing a series of operations...

CVE-2019-5296

Mate20 Huawei smartphones versions earlier than HMA-AL00C00B175 have an out-of-bounds read vulnerability. An attacker with a high permission runs some specific commands on the smartphone. Due to insufficient input verification, successful exploit may cause out-of-bounds read of the memory and the...

CVE-2019-5306

The CVE-2019-5306 FRP bypass affects Huawei P20 smartphones prior to Emily-AL00A 9.0.0.167(C00E81R1P21T8). According to connected sources, when reconfiguring via FRP, an attacker can bypass the activation lock and gain access to the device. Root cause is a bypass in Factory Reset Protection durin...

CVE-2019-5296

Huawei Mate20 smartphones running versions earlier than HMA-AL00C00B175 are affected by an out-of-bounds read due to insufficient input verification. The issue allows an attacker with high privileges to execute specific commands, potentially causing memory reads and a system abnormal state. The v...

CVE-2019-5281

There is an information leak vulnerability in some Huawei phones, versions earlier than Jackman-L21 8.2.0.155C185R1P2. When a local attacker uses the camera of a smartphone, the attacker can exploit this vulnerability to obtain sensitive information by performing a series of operations...

CVE-2019-5281

CVE-2019-5281 affects Huawei smartphones (pre-8.2.0.155) with Jackman-L21 variants. Root cause: information leakage when a local attacker uses the device camera, enabling access to sensitive data. Impact per sources: partial confidentiality loss with local access and no indicated integrity/availa...

Unpatched Flaw in Xiaomi's Built-in Browser App Lets Hackers Spoof URLs

EXCLUSIVE — Beware, if you are using a Xiaomi's Mi or Redmi smartphone, you should immediately update its built-in MI browser or the Mint browser available on Google Play Store for non-Xiaomi Android devices. That's because both web browser apps created by Xiaomi are vulnerable to a critical...

Recovering Smartphone Typing from Microphone Sounds

Yet another side-channel attack on smartphones: "Hearing your touch: A new acoustic side channel on smartphones," by Ilia Shumailov, Laurent Simon, Jeff Yan, and Ross Anderson. Abstract: We present the first acoustic side-channel attack that recovers what users type on the virtual keyboard of the...