Sorcery 后置链接漏洞

Sorcery is an authentication software package. A backlink vulnerability exists in play-sorcery-kms in Sorcery version 0.6.0. A local attacker can exploit this vulnerability to gain root privileges by attacking /tmp/replay-sorcery or /tmp/replay-sorcery/device.sock via symbolic links...

Updated Joker Malware Floods into Android Apps

The Joker mobile trojan is back on Google Play, with an uptick in malicious Android applications that hide the billing-fraud malware, researchers said. It’s also using new approaches to skirt past Google’s app-vetting process. Joker has been around since 2017, disguising itself within common,...

Cloud Cryptomining Swindle in Google Play Rakes in Cash

Bogus cryptomining apps for Android available for download on Google Play are estimated to have scammed more than 93,400 victims to date, researchers said, stealing at least $350,000. According to Lookout, the apps – categorized into “BitScam” and “CloudScam” versions – advertise themselves as...

Android Apps in Google Play Harvest Facebook Credentials

A set of nine malicious Android apps that steal Facebook credentials were found on Google Play, which racked up a collective 5.9 million installations before Google removed them. According to Dr. Web’s malware analysts, the applications were fully functional, so that victims remained in the dark...

9 apps with 6M installs stole Facebook logins of Android users

By Habiba Rashid In total, 10 of these Trojan apps were found, out of which, 9 were available on Google Play. Here is the list of malicious apps. This is a post from HackRead.com Read the original post: 9 apps with 6M installs stole Facebook logins of Android users...

Android Apps with 5.8 million Installs Caught Stealing Users' Facebook Passwords

Google intervened to remove nine Android apps downloaded more than 5.8 million times from the company's Play Store after the apps were caught furtively stealing users' Facebook login credentials. "The applications were fully functional, which was supposed to weaken the vigilance of potential...

Facebook Sues 4 Vietnamese for Hacking Accounts and $36 Million Ad Fraud

Facebook on Tuesday revealed it filed two separate legal actions against perpetrators who abused its ad platform to run deceptive advertisements in violation of the company's Terms and Advertising Policies. "In the first case, the defendants are a California marketing company and its agents...

Google now requires app developers to verify their address and use 2FA

Google on Monday announced new measures for the Play Store, including requiring developer accounts to turn on 2-Step Verification 2SV, provide an address, and verify their contact details later this year. The new identification and two-factor authentication requirements are a step towards...

Kids’ Apps on Google Play Rife with Privacy Violations

About 20 percent of the Top 500 kids’ mobile apps in the Google Play store are collecting data on users in a way that likely violates the Children’s Online Privacy Protection Act COPPA. These have been downloaded by a collective 492 million users, researchers said. That’s according to an analysis...

Watch out Android users as Joker malware is back on Play Store

By Deeba Ahmed In the past three years, the Joker malware has made headlines quite frequently by invading applications available on Google Play Store. This is a post from HackRead.com Read the original post: Watch out Android users as Joker malware is back on Play Store...

Malware infected Minecraft modpacks hit Google Play Store

By Deeba Ahmed According to researchers, Minecraft continues to attract the hacking community and a massive increase in infected, malware-laden Minecraft mods. This is a post from HackRead.com Read the original post: Malware infected Minecraft modpacks hit Google Play Store...

gupnp: allows DNS rebinding which could result in tricking browser into triggering actions against local UPnP services

A flaw was found in gupnp. DNS rebinding can occur when a victim's browser is used by a remote web server to trigger actions against local UPnP services including data exfiltration, data tempering, and other exploits. The highest threat from this vulnerability is to data confidentiality and...

gupnp: allows DNS rebinding which could result in tricking browser into triggering actions against local UPnP services

A flaw was found in gupnp. DNS rebinding can occur when a victim's browser is used by a remote web server to trigger actions against local UPnP services including data exfiltration, data tempering, and other exploits. The highest threat from this vulnerability is to data confidentiality and...

Google to Let Android Users Opt-Out to Stop Ads From Tracking Them

Google is tightening its privacy practices that could make it harder for apps on Android phones and tablets to track users who have opted out of receiving personalized interest-based ads. The change will go into effect sometime in late 2021. The development, which mirrors Apple's move to enable...

‘Battle for the Galaxy’ Mobile Game Leaks 6M Gamer Profiles

An Elasticsearch server holding personal data of 6 million players of the popular mobile game Battle for the Galaxy was discovered insecure and containing over 1 terabyte of unencrypted data, meaning anyone with a link could access data stored on the repository. Ethical hackers WizCase found the...

USN-4970-1 gupnp vulnerability

It was discovered that GUPnP incorrectly filtered local requests. If a user were tricked into visiting a malicious website, a remote attacker could possibly use this issue to perform actions against local UPnP services such as obtaining or altering sensitive information...

DEBIAN-CVE-2021-33516

An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected...

23 Android Apps Expose Over 100,000,000 Users' Personal Data

Misconfigurations in multiple Android apps leaked sensitive data of more than 100 million users, potentially making them a lucrative target for malicious actors. "By not following best-practices when configuring and integrating third-party cloud-services into applications, millions of users'...

hostapd: UPnP SUBSCRIBE misbehavior in WPS AP

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue...

4 Major Privacy and Security Updates From Google You Should Know About

Google has announced a number of user-facing and under-the-hood changes in an attempt to boost privacy and security, including rolling out two-factor authentication automatically to all eligible users and bringing iOS-styled privacy labels to Android app listings. "Today we ask people who have...