Google Collects Android Location Data Even When Location Service Is Disabled

Do you own an Android smartphone? If yes, then you are one of those billions of users whose smartphone is secretly gathering location data and sending it back to Google. Google has been caught collecting location data on every Android device owner since the beginning of this year that's for the...

CVE-2017-7148

An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Location Framework" component. It allows attackers to obtain sensitive location information via a crafted app that reads the location variable...

CVE-2017-7145

An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Time" component. The "Setting Time Zone" feature mishandles the possibility of using location data...

CVE-2017-7145

An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Time" component. The "Setting Time Zone" feature mishandles the possibility of using location data...

Code injection

An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Time" component. The "Setting Time Zone" feature mishandles the possibility of using location data...

CVE-2017-7145

CVE-2017-7145 affects iOS before 11 in the Time component, specifically the Time Zone setting that may misuse location data. The Apple security content entry notes a permissions issue in the time zone handling process, addressed by modifying permissions. Connected references corroborate the issue...

CVE-2017-7145

An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Time" component. The "Setting Time Zone" feature mishandles the possibility of using location data...

Apple iOS Time has an unspecified vulnerability

Apple iOS is an operating system developed by Apple Inc. for mobile devices.Time component is one of the time components. A security vulnerability exists in the Time component of Apple iOS prior to version 11, which arises from the possibility that the program fails to properly handle the use of...

The vulnerability of the UE component in the Android CAF-release operating system allows a perpetrator to compromise privacy, integrity, and accessibility.

The vulnerability of the UE component in the Android CAF-release operating system is related to positioning errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information when the UE driver sends unprotected...

The vulnerability of the UE component in the Android CAF-release operating system allows a perpetrator to compromise privacy, integrity, and accessibility.

The vulnerability of the UE component in the Android CAF-release operating system is related to positioning errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information when the UE driver sends unprotected...

Do the Police Need a Search Warrant to Access Cell Phone Location Data?

The US Supreme Court is deciding a case that will establish whether the police need a warrant to access cell phone location data. This week I signed on to an amicus brief from a wide array of security technologists outlining the technical arguments as why the answer should be yes. Susan Landau...

Arbitrary Account Login Vulnerability in Dingtone Travel App

Dingtone Travel APP is a new energy car sharing platform based on internet technology. A design flaw vulnerability exists in the Dingtone Mobility Android APP's cell phone SMS verification code login function, allowing attackers to exploit the vulnerability to log in to another person's account...

Tracking Devices Latest Privacy Risk to Users

Update: TrackR has responded to Rapid7’s disclosure. First, it said it has addressed the authentication issue months ago, but the deprecated call remained online even though it was no longer used by its apps. “We are grateful that Rapid7 brought this possible point of confusion to our attention; ...

Mobile Applications Leak Device, Location Data

Both Android and iOS apps leak data, leaving users vulnerable to data theft, denial-of-service attacks, and remote SIM card rooting. In a report released Thursday “Are mobile apps a leaky tap in the enterprise?” researchers at Zscaler assert that Android and iOS users are equally vulnerable to a...

Foreman API and UI Privilege Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A privilege-lifting vulnerability exists in the Foreman API and UI. When a restricted user from a specif...

CVE-2016-1779

WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request...

UBUNTU-CVE-2016-1779

WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request...

CVE-2016-1779

WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request...

Apple Patches iOS Ins0mnia Vulnerability

Apple’s monster security update of Aug. 13 included a patch for an iOS vulnerability that could beacon out location data and other personal information from a device, even if a particular task has been shut off by the user. A mobile app exploiting this vulnerability could also look benign enough ...

CVE-2014-4453

Apple iOS before 8.1.1 and OS X before 10.10.1 include location data during establishment of a Spotlight Suggestions server connection by Spotlight or Safari, which might allow remote attackers to obtain sensitive information via unspecified vectors...