CVE-2016-3876

providers/settings/SettingsProvider.java in Android 6.x before 2016-09-01 and 7.0 before 2016-09-01 allows physically proximate attackers to bypass the SAFEBOOTDISALLOWED protection mechanism and boot to safe mode via the Android Debug Bridge adb tool, aka internal bug 29900345...

CVE-2016-3890

The Java Debug Wire Protocol JDWP implementation in adb/sockets.cpp in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 mishandles socket close operations, which allows attackers to gain privileges via a crafted application, aka internal bug 28347842...

CVE-2016-3890: Undefined Security Weakness

The Java Debug Wire Protocol JDWP implementation in adb/sockets.cpp in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 mishandles socket close operations, which allows attackers to gain privileges via a crafted application, aka internal bug 28347842...

PT-2016-5708

Name of the Vulnerable Software and Affected Versions Android versions 6.x through 7.0 before 2016-09-01 Description The issue allows physically proximate attackers to bypass the SAFE BOOT DISALLOWED protection mechanism and boot to safe mode via the Android Debug Bridge adb tool. Recommendations...

CVE-2016-3876: Undefined Security Weakness

providers/settings/SettingsProvider.java in Android 6.x before 2016-09-01 and 7.0 before 2016-09-01 allows physically proximate attackers to bypass the SAFEBOOTDISALLOWED protection mechanism and boot to safe mode via the Android Debug Bridge adb tool, aka internal bug 29900345...

Patch Fixes Nexus 5X Lock-Screen Bypass Vulnerability

Google’s Android security team has patched a vulnerability that left Nexus 5X devices open to attack even if the phone’s screen was locked. The vulnerability in Google’s line of phones would have allowed an adversary to exfiltrate data from the targeted phone via a forced memory dump of the devic...

Lobotomy - Android Reverse Engineering Framework & Toolkit

Lobotomy is an Android security toolkit that will automate different Android assessments and reverse engineering tasks. The goal of the Lobotomy toolkit is to provide a console environment, which would allow a user to load their target Android APK once, then have all the necessary tools without...

Android Pentesting Portable Integrated Environment: Appie

Appie is a software package that has been pre-configured to function as an Android Pentesting Environment on any windows based machine without the need of a Virtual MachineVM or dualboot. It is completely portable and can be carried on USB stick or your smartphone. It is one of its kind Android...

How to collect ADB and XCODE logs for XenMobile

To make users aware on how they can collect the ADB logs and XCODE logs...

Google Android ADB Debug Server - Remote Payload Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/proto/adb' class Metasploit3 'Android ADB Debug Server Remote Payload Execution', 'Description' = %q Writes and spawns a native payload on...

Android ADB Debug Server Remote Payload Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/proto/adb' class Metasploit3 'Android ADB Debug Server Remote Payload Execution', 'Description' = %q Writes and spawns a native payload on...

Android ADB Debug Server Remote Payload Execution

Writes and spawns a native payload on an Android device that is listening for adb debug messages. Module Options msf use exploit/android/adb/adb/serverexec msf undefinedserverexec show actions ...actions... msf undefinedserverexec set ACTION msf undefinedserverexec show options ...show and set...

VTech Tablet: a plurality of data breach risks hidden-vulnerability warning-the black bar safety net

! In a recent VTech data leak after the event, everyone might think that VTech electronic toy safety won't be better than now worse. However, in this case, we found two vulnerabilities, a hacker can be from the children of their innotab tablet in grabbing data. Brush mode to steal data For lost,...

Huawei HG253s V2 Information Disclosure

Huawei HG253s v2 Vodafone-Spain is starting to rent a new Huawei HG253v2 router to the spanish costumers. This new router is coming with a new firmware version. This bug has been found by @VicenDominguez Vulnerability Basically, it is not validating the session cookie in some administration...

Quick Android Review Kit: QARK

Quick Android Review Kit – This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating “Proof-of-Concept” deployable APKs and/or ADB commands, capable of exploiting many of the...

CVE-2014-7952, Android ADB backup APK injection vulnerability

The Android operating system offers a backup/restore mechanism of installed packages through the ADB utility. Full backup of applications including the private files stored on /data partition is performed by default, but applications can customize this behavior by implementing a BackupAgent class...

Android adb backup vulnerability exists that can be injected into the malicious APK-vulnerability warning-the black bar safety net

! Android in the system backup after the restore process on the existence of a serious Vulnerability, CVE-2 0 1 4-7 9 5 2, and so an attacker can inject malicious apk file to a backup filethus reducing the time a malicious app installed on the go. The vulnerability is by the Android command-line...

Bug in Android ADB Backup System Can Allow Injection of Malicious Apps

There’s a severe vulnerability in the way that all versions of Android handle the restoration of backups that can allow an attacker to inject a malicious APK file into the backup archive. The bug is the result of an issue with the ADB command-line tool for Android and the researchers who discover...

Amazon Patches Certificate Vulnerabilities in Fire Phones

Amazon last week patched three vulnerabilities in its Fire smartphones, including two in its Certinstaller package that put devices at risk. An attacker could take advantage of the vulnerability in the package, which allows mobile apps to install certificates on Amazon Fire devices without user...

CVE-2015-1188

The certificate verification functions in the HNDS service in Swisscom Centro Grande ADB DSL routers with firmware before 6.14.00 allows remote attackers to access the management functions via unknown vectors...