CVE-2020-0121

In updateUidProcState of AppOpsService.java, there is a possible permission bypass due to a logic error. This could lead to local information disclosure of location data with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2020-0121: Undefined Security Weakness

In updateUidProcState of AppOpsService.java, there is a possible permission bypass due to a logic error. This could lead to local information disclosure of location data with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

PT-2020-11482

Name of the Vulnerable Software and Affected Versions Android versions Android-10 Description A logic error in the updateUidProcState of AppOpsService.java could lead to a permission bypass, resulting in local information disclosure of location data. This issue requires User execution privileges...

Utah Says No to Apple/Google COVID-19 Tracing; Debuts Startup App

The state of Utah has settled on a contact-tracing mobile app that collects detailed user location information to track the spread of COVID-19 among citizens – eschewing the API model proposed by Apple and Google in April. The app is called “Healthy Together” and it was created by a startup calle...

Leaked NHS Docs Reveal Roadmap, Concerns Around Contact-Tracing App

A COVID-19 contact-tracing app to be rolled out by the UK’s National Health Service NHS has been thrust into the spotlight thanks to sensitive documents being leaked via a public Google Drive link. Contact tracing has emerged as a top idea for dealing with the coronavirus pandemic and is consider...

WAVLINK WL-WN579G3, WL-WN575A3 and WL-WN530HG4 License Issue Vulnerabilities

WAVLINK WL-WN579G3 and others are a wireless network signal extender from China's RuiYin Technology WAVLINK. A security vulnerability exists in WAVLINK WL-WN579G3 M79X3.V5030.180719, WL-WN575A3 RPT75A3.V4300.180801, and WL-WN530HG4 M30HG4.V5030.191116, which originates from externally accessible...

Global Surveillance in the Wake of COVID-19

OneZero is tracking thirty countries around the world who are implementing surveillance programs in the wake of COVID-19: The most common form of surveillance implemented to battle the pandemic is the use of smartphone location data, which can track population-level movement down to enforcing...

Chinese Hackers Using New iPhone Hack to Spy On Uyghur Muslims

A Chinese hacking group has been found leveraging a new exploit chain in iOS devices to install a spyware implant targeting the Uyghur Muslim minority in China's autonomous region of Xinjiang. The findings, published by digital forensics firm Volexity, reveal that the exploit — named "Insomnia" —...

How Apple and Google's Social Distancing Maps Work

New tools from the tech giants shows the dramatic impact of sheltering in place, using location data from phones like yours...

Google Receives Geofence Warrants

Sometimes it's hard to tell the corporate surveillance operations from the government ones: Google reportedly has a database called Sensorvault in which it stores location data for millions of devices going back almost a decade. The article is about geofence warrants, where the police go to...

The iPhone 11 Pro’s Location Data Puzzler

One of the more curious behaviors of Apple's new iPhone 11 Pro is that it intermittently seeks the user's location information even when all applications and system services on the phone are individually set to never request this data. Apple says this is by design, but that response seems at odds...

This Smartwatch is exposing real-time location data of thousands of kids

By Sudais The manufacturer of this Smartwatch has been informed yet they have not taken any steps to stop the data from pubic exposure. This is a post from HackRead.com Read the original post: This Smartwatch is exposing real-time location data of thousands of kids...

CVE-2019-16256

Some Samsung devices include the SIMalliance Toolbox Browser aka S@T Browser on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit STK instructions in an SMS message, aka Simjacker...

Flaws in Over Half a Million GPS Trackers Expose Children Location Data

What if the tech intended to ensure that your kids, senior citizens, and pets are safe even when they're out of sight inadvertently expose them to stalkers? An estimated 600,000 GPS tracking devices for sale on Amazon and other large online merchants for $25–$50 have been found vulnerable to a...

Implant Teardown

Posted by Ian Beer, Project Zero In the earlier posts we examined how the attackers gained unsandboxed code execution as root on iPhones. At the end of each chain we saw the attackers calling posixspawn, passing the path to their implant binary which they dropped in /tmp. This starts the implant...

Who Owns Your Wireless Service? Crooks Do.

Incessantly annoying and fraudulent robocalls. Corrupt wireless company employees taking hundreds of thousands of dollars in bribes to unlock and hijack mobile phone service. Wireless providers selling real-time customer location data, despite repeated promises to the contrary. A noticeable uptic...

A Likely Chinese Hacker Crew Targeted 10 Phone Carriers to Steal Metadata

In one case, they stole the location and call record data of 20 specific individuals...

Twitter Leaks Apple iOS Users' Location Data to Ad Partner

Twitter has disclosed a security bug in its platform that it said inadvertently leaked iOS users’ location data. The Twitter for iOS bug leaked location data at the ZIP code or city level, according to the social media company’s announcement on Monday. Twitter stressed that it has fixed the bug,...

Amazon Employees Given 'Broad Access' to Personal Alexa Info

Employees at Amazon can access geolocation information for Alexa users, according to reports – thus uncovering their home addresses and even satellite pictures of their houses generated from a service such as Google Earth. Alexa is the built-in voice assistant shipped with devices like Amazon Ech...

Google Helps Police Identify Devices Close to Crime Scenes Using Location Data

It's no secret that Google tracks you everywhere, even when you keep Google's Location History feature disabled. As revealed by an Associated Press investigation in 2018, other Google apps like Maps or daily weather update service on Android allows the tech giant to continuously collect your...