PT-2024-5208

Name of the Vulnerable Software and Affected Versions: CocoaPods affected versions not specified Description: The issue is related to the CocoaPods dependency manager, specifically affecting older pods that migrated from the pre-2014 pull request workflow to trunk. If a pod had never been claimed...

[SECURITY] Fedora 38 Update: mvfst-2023.10.16.00-1.fc38

mvfst Pronounced move fast is a client and server implementation of IETF QU IC protocol in C++ by Facebook. QUIC is a UDP based reliable, multiplexed transp ort protocol that will become an internet standard. The goal of mvfst is to build a performant implementation of the QUIC transport protocol...

CVE-2022-39255

Summary (CVE-2022-39255): The Matrix iOS SDK (prior to 0.23.19) is vulnerable to protocol confusion between Megolm and Olm for to-device messages. An attacker collaborating with a malicious homeserver can craft messages that appear to come from another user, enabling impersonation and targeted at...

Spying on the spies. See what JavaScript commands get injected by in-app browsers

Developer and privacy expert Felix Krause aka KrauseFx announced this week that he had introduced a simple tool to list the JavaScript commands executed by iOS apps when they deployed an in-app web browser to render webpages. He already shared some eye-opening results on his Twitter feed. By...

Fuzzing iOS code on macOS at native speed

Or how iOS apps on macOS work under the hood Posted by Samuel Groß, Project Zero This short post explains how code compiled for iOS can be run natively on Apple Silicon Macs. With the introduction of Apple Silicon Macs, Apple also made it possible to run iOS apps natively on these Macs. This is...

Malicious SDK found spying & defrauding users through iOS apps

By Deeba Ahmed The malicious SDK is distributed by China-based firm Mintegral. This is a post from HackRead.com Read the original post: Malicious SDK found spying & defrauding users through iOS apps...

This Week in Security News: Trend Micro Acquires Cloud Conformity and Apple Removes Malicious iOS Apps from App Store

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about Trend Micro’s recent acquisition of Cloud Conformity. Also, read about a fake photo editing app on Google Play and the 17...

Vulnerable Twitter API Leaves Tens of Thousands of iOS Apps Open to Attacks

Researchers are warning that an old Twitter API still used by popular iOS mobile apps that could be abused as part of a man-in-the-middle attack. It could be used to hijack Twitter accounts and compromise other third-party apps that are linked to the same “login with Twitter” feature. According t...

Apple will let users run iOS apps on macOS

Apple is making it easier for mobile developers to port their iOS apps to the next-generation macOS Mojave desktop platform—a major step in bringing the two platforms closer together. However, at the same time, the company straightforward denied the idea of merging the iPhone and Mac operating...

XenMobile MDX Service

You can use the XenMobile MDX Service to prepare iOS and Android mobile apps by wrapping the apps with MDX, an app container technology. You then manage the apps with XenMobile. You can use the XenMobile MDX Service to wrap apps created within your organization or to wrap the Citrix XenMobile App...

Popular iOS Apps Vulnerable to TLS Interception Attacks

Dozens of iOS mobile banking, medical and other applications handling sensitive user information are vulnerable to man-in-the-middle attacks where TLS traffic can be intercepted. Of the 76 apps analyzed by Sudo Security Group, 19 are considered high-risk where financial or medical credentials, or...

iBackDoor: the suspected back door, the impact of the iOS app a high risk of code-bug warning-the black bar safety net

! Recently, FireEye Mobile Security researchers discovered embedded into the iOS app in the suspected“back door”behavior mobiSage advertising in the library, and these applications are from the App Store. The researchers will be the potential of the back door called iBackDoor, allowing hackers...

iBackDoor: High-Risk Code Hits iOS Apps

Introduction FireEye mobile researchers recently discovered potentially “backdoored” versions of an ad library embedded in thousands of iOS apps originally published in the Apple App Store. The affected versions of this library embedded functionality in iOS apps that used the library to display...

More than 250 iOS Apps Caught Using Private APIs to Collect Users' Private Data

Apple is cleaning up its iTunes App Store again – for the third time in two months – following another flood of iOS apps that secretly collect users’ personal information. Researchers discovered more than 250 iOS apps that were violating Apple's App Store privacy policy, gathering personal...

Popular iOS network communications library AFNetworking exposed SSL vulnerability, the impact of China UnionPay, Bank of China, Bank of communications, 2. 5 million iOS applications-vulnerability warning-the black bar safety net

A presence in the popular open source iOS network communications library AFNetworking in severe vulnerability that the Apple App Store 2 5 0 0 0 a iOS app in HTTPS traffic exposure in-the-middle（MITM attack. AFNetworking is a famous open source network library, to be able to developers in iOS and...

Critical SSL Vulnerability Leaves 25,000 iOS Apps Vulnerable to Hackers

A critical vulnerability resides in AFNetworking could allow an attacker to cripple the HTTPS protection of 25,000 iOS apps available in Apple's App Store via man-in-the-middle MITM attacks. AFNetworking is a popular open-source code library that lets developers drop networking capabilities into...

iOS apps vulnerable to HTTP Request Hijacking attacks over WiFi

Security researchers Adi Sharabani and Yair Amit have disclosed details about a widespread vulnerability in iOS apps, that could allow hackers to force the apps to send and receive data from the hackers' own servers rather than the legitimate ones they were coded to connect to. Speaking about the...

iOS apps vulnerable to HTTP Request Hijacking attacks over WiFi

Security researchers Adi Sharabani and Yair Amit have disclosed details about a widespread vulnerability in iOS apps, that could allow hackers to force the apps to send and receive data from the hackers' own servers rather than the legitimate ones they were coded to connect to. Speaking about the...

AdiOS Finds iOS Apps Capable of Dumping Users' Contacts

It’s gotten to the point now where it’s almost easier to talk about the mobile apps and services that don’t ship your personal data off to some remote server for purposes unknown rather than discussing the ones that do. The latest discussion of privacy invading apps flowed from the discovery that...