CVE-2018-17500

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of hardcoded OAuth Creds in plaintext. An attacker could exploit this vulnerability to obtain sensitive information...

Information disclosure

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive information...

Hardcoded credentials

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of hardcoded OAuth Creds in plaintext. An attacker could exploit this vulnerability to obtain sensitive information...

CVE-2018-17499

CVE-2018-17499 affects Envoy Passport for Android and Envoy Passport for iPhone. Connected CNVD-2019-08356 confirms an information-disclosure vulnerability caused by storing unencrypted data in logs, enabling a local attacker to access sensitive information such as two API keys and a token. Affec...

CVE-2018-17500

CVE-2018-17500 details (from provided documents) : Envoy Passport for Android and Envoy Passport for iPhone store hardcoded OAuth credentials in plaintext, enabling a local attacker to obtain sensitive information. The vulnerability is triggered by insecure storage of credentials in the applicati...

CVE-2018-17499

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive information...

CVE-2018-17500

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of hardcoded OAuth Creds in plaintext. An attacker could exploit this vulnerability to obtain sensitive information...

"an" App for iOS vulnerable to directory traversal

Overview "an" App for iOS provided by PERSOL CAREER CO., LTD. uses the old version of cordova-plugin-ionic-webview, and inherits a directory traversal vulnerability CWE-22, CVE-2018-16202. Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc. reported this Vuerability to IPA. JPCERT/CC...

Spam and phishing in 2018

Numbers of the year The share of spam in mail traffic was 52.48%, which is 4.15 p.p. less than in 2017. The biggest source of spam this year was China 11.69%. 74.15% of spam emails were less than 2 KB in size. Malicious spam was detected most commonly with the Win32.CVE-2017-11882 verdict. The...

iPhone hacking tool Cellebrite being sold on eBay

By Waqas Cellebrite UFED, an iPhone hacking tool made in Israel and widely used by the law enforcement authorities including the Federal Bureau of Investigation, Customs Enforcement and Immigration departments is surprisingly up for sale on eBay. This tool is mainly used for hacking or breaking...

Beers with Talos Ep. #46 - Privacy Pwnd: ExileRAT and Collecting Bad Karma

Beers with Talos BWT Podcast Ep. 46 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Ep. 46 show notes: Recorded Feb. 1, 2019 Today we discuss threats that bridge the gap between violating privacy and classic...

PT-2019-6083 · Apple · Macos Mojave +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 12.1.4 macOS Mojave versions prior to 10.14.3 Supplemental Update Description: A memory corruption issue was addressed with improved input validation, allowing an application to potentially gain elevated privileges. The...

PT-2019-6110 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: Apple iOS versions prior to 12.1.4 Apple macOS versions prior to 10.14.3 Supplemental Update Description: A logic issue existed in the handling of Group FaceTime calls, which may allow the initiator to cause the recipient to answer. The issue...

This Week in Security News: Hacker Strategies and Spyware Attacks

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about how hackers are improving their breach strategies. Also, learn about new spyware attacks via URLs, websites, and mobile apps. Re...

New Mac Malware steals iPhone text messages from iTunes backups

By Waqas The IT security researchers at Palo Alto Networks’ Unit 42 have discovered a dangerous new Mac malware capable of targeting devices for multi-purposes including stealing cryptocurrency. Dubbed CookieMiner by researchers; the Mac malware is a variant of OSX.DarthMiner, another nasty piece...

Examining Pointer Authentication on the iPhone XS

Posted by Brandon Azad, Project Zero In this post I examine Apple's implementation of Pointer Authentication on the A12 SoC used in the iPhone XS, with a focus on how Apple has improved over the ARM standard. I then demonstrate a way to use an arbitrary kernel read/write primitive to forge kernel...

Apple iOS, watchOS and macOS Mojave Natural Language Processing Denial of Service Vulnerability

Apple iOS, watchOS, and macOS Mojave are products of Apple Inc. Apple iOS is an operating system for mobile devices; watchOS is an operating system for smartwatches; and macOS Mojave is a specialized operating system for Mac computers. Natural Language Processing is one of the natural language...

iPhone FaceTime Vulnerability

This is kind of a crazy iPhone vulnerability: it's possible to call someone on FaceTime and listen on their microphone -- and see from their camera -- before they accept the call. This is definitely an embarrassment, and Apple was right to disable Group FaceTime until it's fixed. But it's hard to...

Apple Disables Group FaceTime Following Major Privacy Glitch

Apple has made Group FaceTime temporarily unavailable following a major flaw discovered on Monday evening. The bug allows anyone with iOS to FaceTime other iOS users and listen in on their private conversations – without the user on other end rejecting or accepting the call. The bug makes use of ...

New FaceTime Bug Lets Callers Hear and See You Without You Picking Up

If you own an Apple device, you should immediately turn OFF FaceTime app for a few days. A jaw-dropping unpatched privacy bug has been uncovered in Apple's popular video and audio call app FaceTime that could let someone hear or see you before you even pick up your call. The bug is going viral on...