170 fraudulent Android apps scamming cryptocurrency enthusiasts

By Deeba Ahmed So far, these fake Android app developers have managed to steal money from 93,000 users and raked in around $350,000. This is a post from HackRead.com Read the original post: 170 fraudulent Android apps scamming cryptocurrency enthusiasts...

Cloud Cryptomining Swindle in Google Play Rakes in Cash

Bogus cryptomining apps for Android available for download on Google Play are estimated to have scammed more than 93,400 victims to date, researchers said, stealing at least $350,000. According to Lookout, the apps – categorized into “BitScam” and “CloudScam” versions – advertise themselves as...

Android Apps in Google Play Harvest Facebook Credentials

A set of nine malicious Android apps that steal Facebook credentials were found on Google Play, which racked up a collective 5.9 million installations before Google removed them. According to Dr. Web’s malware analysts, the applications were fully functional, so that victims remained in the dark...

9 apps with 6M installs stole Facebook logins of Android users

By Habiba Rashid In total, 10 of these Trojan apps were found, out of which, 9 were available on Google Play. Here is the list of malicious apps. This is a post from HackRead.com Read the original post: 9 apps with 6M installs stole Facebook logins of Android users...

Android Apps with 5.8 million Installs Caught Stealing Users' Facebook Passwords

Google intervened to remove nine Android apps downloaded more than 5.8 million times from the company's Play Store after the apps were caught furtively stealing users' Facebook login credentials. "The applications were fully functional, which was supposed to weaken the vigilance of potential...

SMS authentication code includes ad: a very bad idea

SMS authentication codes are back in the news, and the word Id use to summarise their reappearance is "embattled." I can still remember a time where two-factor authentication 2FA, authentication grids, regional lockouts, Yubikeys, and offline authentication apps simply did not exist. And if they...

ASB-A-175213041

In sendNetworkConditionsBroadcast of NetworkMonitor.java, there is a possible way for a privileged app to receive WiFi BSSID and SSID without location permissions due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User...

jetty: local temporary directory hijacking vulnerability

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub...

CVE-2021-34375

Trusty contains a vulnerability in all trusted applications TAs where the stack cookie was not randomized, which might result in stack-based buffer overflow, leading to denial of service, escalation of privileges, and information disclosure...

Remote dating: How do the apps safeguard our data?

The pandemic and the restrictions that came with it have led to an increase in the popularity of dating apps. For example, the total number of swipes on Tinder increased by 11% last year, with the daily number of swipes surpassing the 3 billion mark for the first time as early as March 2020. This...

New API Lets App Developers Authenticate Users via SIM Cards

Online account creation poses a challenge for engineers and system architects: if you put up too many barriers, you risk turning away genuine users. Make it too easy, and you risk fraud or fake accounts. The Problem with Identity Verification The traditional model of online identity –...

jetty: local temporary directory hijacking vulnerability

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub...

Super Progressive Web Apps < 2.1.13 - Authenticated (High Privileged) Arbitrary File Upload to RCE

When the Apple Touch Icons & Splash Screen add-on is active, its superpwasplashscreenuploader AJAX action, did not properly check for authorisation and the content of the uploaded archive file. This allows high privilege users admin+ to upload an archive with a PHP file, leading to RCE. v2.1.12...

WordPress Super Progressive Web Apps plugin <= 2.1.12 - Authenticated Arbitrary File Upload vulnerability leading to Remote Code Execution (RCE)

Authenticated Arbitrary File Upload vulnerability leading to Remote Code Execution RCE discovered by WPScan Team in WordPress Super Progressive Web Apps plugin versions = 2.1.12. Solution Update the WordPress Super Progressive Web Apps plugin to the latest available version at least 2.1.13...

Error: Element Not Found on launching. ica file with Citrix Workspace app (from Microsoft Store)

Note: This issue applies to, Citrix Workspace app Microsoft store. Launching a virtual app or desktop using .ica file with Citrix Workspace app for Windows Microsoft store version leads to “Element not found” Error...

Super Progressive Web Apps < 2.1.13 - Authenticated (High Privileged) Arbitrary File Upload to RCE

When the Apple Touch Icons & Splash Screen add-on is active, its superpwasplashscreenuploader AJAX action, did not properly check for authorisation and the content of the uploaded archive file. This allows high privilege users admin+ to upload an archive with a PHP file, leading to RCE. v2.1.12...

Connection Interrupted, issue reported with different version of Citrix Virtual Apps and Desktops

You may see user sessions are getting disconnected at launch, incomplete ghost session with name "-" is seen on the VDA and Connection Interrupted error for user. if vda have Microsoft defender Anti virus...

Kids’ Apps on Google Play Rife with Privacy Violations

About 20 percent of the Top 500 kids’ mobile apps in the Google Play store are collecting data on users in a way that likely violates the Children’s Online Privacy Protection Act COPPA. These have been downloaded by a collective 492 million users, researchers said. That’s according to an analysis...

Apollos Apps licensing issue vulnerability

Apollos Apps is an open source platform for distributing church-related applications. Apollos Apps suffers from an authorization issue vulnerability that stems from the fact that new user registrations only need to know basic personal information about anyone name, birthday, gender, etc. in order...

CVE-2021-32691

Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information name, birthday, gender, etc. This includes all app functionality within t...