Fake Call and Fake SMS - MIT license, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Fake Call and Fake SMS published at the 'play' market has multiple vulnerabilities...

Fake Call Prank - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Fake Call Prank published at the 'play' market has multiple vulnerabilities...

Fake Prank Call - Simulator - Base64 encoded String, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Fake Prank Call - Simulator published at the 'play' market has multiple vulnerabilities...

Fake Call Prank - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Fake Call Prank published at the 'play' market has multiple vulnerabilities...

Fake Call 2 - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Fake Call 2 published at the 'play' market has multiple vulnerabilities...

It's Our Secret.Fake Marriage - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application It's Our Secret.Fake Marriage published at the 'play' market has multiple vulnerabilities...

Fake Call Boyfriend Boys India - Customized SSL, Dynamic Code Loading, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Fake Call Boyfriend Boys India published at the 'play' market has multiple vulnerabilities...

Yazzy (Fake Conversations) - Dangerous filesystem permissions, MIT license, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Yazzy Fake Conversations published at the 'play' market has multiple vulnerabilities...

Fake Call - Customized SSL, WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Fake Call published at the 'play' market has multiple vulnerabilities...

Photo editor: My Fake Look - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Photo editor: My Fake Look published at the 'play' market has multiple vulnerabilities...

Fake Call - Caller Prank - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Fake Call - Caller Prank published at the 'play' market has multiple vulnerabilities...

Threat Outbreak Alert RuleID22003: Email Messages Distributing Malicious Software on March 31, 2016

Medium Alert ID: 44375 First Published: 2016 March 31 15:49 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22003 may contain the following files: Name | Si...

Researchers Learning More About Petya Ransomware

Researchers are digging through samples of the Petya ransomware, and while they’ve learned some about its inner workings, they still haven’t mastered enough to come up with a decryptor. Petya is the latest twist on crypto-malware. It was found recently targeting companies in Germany in a spam...

Who Viewed Your Profile on Instagram? Obviously, Hackers!

Are you curious about who viewed your profile on Instagram? This is probably the most frequently asked question nowadays, and there are several applications available on Google Play Store and Apple App Store, which claims to offer you the opportunity to see who is looking at your Instagram profil...

Steam Stealer Malware "Booming Business" for Attackers Targeting Gaming Service

Malware that targets Steam accounts has proliferated the gaming platform and become what researchers are calling a “booming business” for cybercriminals over the last few months. The popular platform, owned by Valve, boasts 140 million users and is so ripe for attacks that according to the compan...

Bime: Subdomain takeover due to unclaimed Amazon S3 bucket on a2.bime.io

I noticed BIME is primarily built on Amazon AWS, which spawned my interest. I started looking for DNS entries that were still pointing to S3 buckets that however no longer exist. It appears this was the case for a2.bime.io, which points to an Amazon S3 website bucket in the US East region. Steps ...

Uber: Reflected XSS on Uber.com careers

Location www.uber.com/careers/ Description: It is possible for an attacker to inject an arbitrary javascript into city GET parameter. This leads to phishing, defacing from URL, stealing credentials by using a fake login page and many other client side risks. POC: - Logon to...

Medium: python-rsa

Issue Overview: It was found that python-rsa is vulnerable to Bleichenbacher'06 attack, allowing attacker to fake signatures for any public key with low exponent. CVE-2016-1494 Affected Packages: python-rsa Issue Correction: Run yum update python-rsa or yum update --advisory ALAS-2016-644 to upda...

Simple Yet Effective eBay Bug Allows Hackers to Steal Passwords

A simple, yet effective flaw discovered on eBay's website exposed hundreds of millions of its customers to an advance Phishing Attack. An Independent Security Researcher reported a critical vulnerability to eBay last month that had the capability to allow hackers to host a fake login page, i.e...

DHCP IP exhaustion attack: DHCPwn

DHCPwn is a tool used for testing DHCP IP exhaustion attacks. It can also be used to sniff local DHCP traffic. The DHCP protocol is connectionless and implemented via UDP. These two characteristics allow this attack to be performed. Since there is no actual connection being made between the clien...