toorcon san diego Aug 28th - Sep 3rd. Dig Deep into FlexiSpy for Android by Kai Lu(@k3vinlusec).Quick Conference Review
HITB Singapore August 21-25. The Original Elevat0r - History of a Private Jailbreak by Stefan Esser. The Nightmare of Fragmentation: A Case Study of 200+ Vulnerabilities in Android Phones by BAI GUANGDONG and ZHANG QING.
Tencent Security Conference, August 30-31. Pointer Authentication by Robert James Turner. Finding iOS vulnerabilities in an easy way by Tiefel Wang and Hao Xu. Bare-metal program tracing on ARM by Ralf-Philipp Weinmann.
44con 13-15 September London, UK. Inside Android's SafetyNet Attestation: What it can and can't do lessons learned from a large scale deployment by Collin Mulliner.
BalCCon2k17 Novi Sad, Vojvodina, Serbia. September 15-17. Mobile phone surveillance with BladeRF by Nikola Rasovic.
T2 October 26-27 Helsinki, Finland. Breaking Tizen by Amihai Neiderman.
DeepSec Vienna 13-17 November. Normal permissions in Android: An Audiovisual Deception by Constantinos Patsakis. How secure are your VoLTE and VoWiFi calls? by Sreepriya Chalakkal.
It was good to see everybody in Vegas, even better meeting new people. Especially some folks I wanted to meet for a long time. I had a good time at WOOT, meeting old friends was especially good. Maybe it helped that it was in the CanSecWest hotel. I link a few relevant papers below.
Stefan Esser is running a kickstarter for an iOS Kernel Exploitation Training Course for Development of a freely available online iOS kernel exploitation training course based on iOS 9.3.5 on 32 bit devices. If you are into iOS security you should support Stefan's project!
Ralf is on point as usual:
Pictures of the month:
Exhibit A) Our communities are tribalized: https://t.co/e1uATFviYT (JTAG on iPhone 4S BB + exploitation of baseband vulns from SIM, in 2014)— Ralf (RPW) (@esizkur) August 19, 2017
Burner kiddies at defcon be like: pic.twitter.com/3QyPTuJwFg— the grugq (@thegrugq) July 22, 2017
Some Chinese USB adapters have a hidden SIM that will send a text message with GPS coordinates to track an unknowing victim… https://t.co/PK5bpkaBmv— Dimitri Bouniol (@dimitribouniol) August 9, 2017
中国のUSB充電アダプター型盗聴器が先進的すぎる。— 若ちゃん (@wk_tyn) August 8, 2017
BootStomp: On the Security of Bootloaders in Mobile Devices (paper)
Fixes in iOS 10.3.3
Reviewing the Security of ASoC Drivers in Android Kernel
Hacking Cell Phone Embedded Systems
Intercept, modify, repeat and attack Android's Binder transactions using Burp Suite
Seccomp filter in Android O
This source code was obtained by reversing a sample of SLocker. It's not the original source code
Trust Issues: Exploiting TrustZone TEEs
Universal Android SSL Pinning bypass with Frida
USING AN RTL-SDR AS A SIMPLE IMSI CATCHER
BROADPWN: REMOTELY COMPROMISING ANDROID AND IOS VIA A BUG IN BROADCOM'S WI-FI CHIPSETS
Surveillance: German police ready to hack WhatsApp messages
Google May Have Just Uncovered An Israeli Surveillance Start-Up Spying On Androids
Gas Pump Skimmer Sends Card Data Via Text
Defeating Samsung KNOX with zero privilege (slides)
Path of Least Resistance: Cellular Baseband to Application Processor Escalation on Mediatek Devices
Port(al) to the iOS Core
New Adventures in Spying 3G & 4G Users: Locate, Track, Monitor
Ghost Telephonist Link Hijack Exploitations in 4G
OnePlus 2 Lack of SBL1 Validation Broken Secure Boot
iOS 10.3.2 XPC Userland Jailbreak Exploit Tutorial - CVE-2017-7047 by Ian Beer (Video)
Samsung: Trustonic t-base TEE does not perform revocation of trustlets
A (hopefully) generic unpacker for packed Android apps
The original elevat0r jailbreak exploit explained
Tinker is a hot-fix solution library for Android, it supports dex, library and resources update without reinstall apk.
Shattered Trust: When Replacement Smartphone Components Attack (paper)
Patch iOS Apps, The Easy Way, Without Jailbreak
Android Banking Trojan misuses accessibility services
Get details and download apps from https://play.google.com by emulating an Android (Nexus 5X) device by default.
vTZ: Virtualizing ARM TrustZone (paper)
objection - runtime mobile exploration
Xposed for Nougat & abforce Submodule Explained, and Why It's Worth Waiting for rovo89's Full Release
A Linux kernel IPC firewall and logger for Android and Binder
White-Stingray: Evaluating IMSI Catchers Detection Applications (paper)
BootStomp: a bootloader vulnerability finder
iOS 11 has a 'cop button' to temporarily disable Touch ID
Simple tool to dynamically discover hidden fastboot OEM commands based on static knowledge
Blue Pill for your Phone
Android Instant Apps: Best practices for managing download size (who has played with instant apps yet?)
Decrypt the iOS SEP
How much does your phone know about you?
Identifying and Evading Android Protections
Breaking Mobile App Protection Mechanisms
Isolation of HALs in Android O
ANTIVIRUS FOR ANDROID HAS A LONG, LONG WAY TO GO
Fake Snapchat in Google Play Store
Next-generation Dex Compiler Now in Preview
Detecting Android Root Exploits by Learning from Root Providers (paper)
Downgrade Attack on TrustZone (paper)
Testing Biometric Authentication
shadow v2 public release
Android O security changes
SonicSpy: Over a thousand spyware apps discovered, some in Google Play
SMS touch sends customer information and SMS messages over a cleartext network
ZIMPERIUM blog post that describes how the Zero Packet Inspection (ZPI) approach is trained
Using Hover to Compromise the Confidentiality of User Input on Android (paper)
Various Scripts for Mobile Pen-testing with Frida
circuit board (PCB) schematics for 30-pin iPod serial debugging
SS7 Attacker Heaven turns into Riot: How to make Nation-State and Intelligence Attackers' lives much harder on mobile networks (slides)
Black Hat USA Las Vegas, July 26-27. ALL YOUR SMS & CONTACTS BELONG TO ADUPS & OTHERS by Angelos Stavrou, Azzedine Benameur, Ryan Johnson. NEW ADVENTURES IN SPYING 3G AND 4G USERS: LOCATE, TRACK & MONITOR by Altaf Shaik, Andrew Martin, Jean-Pierre Seifert, Lucca Hirschi, Ravishankar Borgaonkar, Shinjo Park. SS7 ATTACKER HEAVEN TURNS INTO RIOT: HOW TO MAKE NATION-STATE AND INTELLIGENCE ATTACKERS' LIVES MUCH HARDER ON MOBILE NETWORKS by Martin Kacer, Philippe Langlois. FIGHTING TARGETED MALWARE IN THE MOBILE ECOSYSTEM by Andrew Blaich, Megan Ruthven. GHOST TELEPHONIST LINK HIJACK EXPLOITATIONS IN 4G LTE CS FALLBACK by Haoqi Shan, Jun Li, Lin Huang, Qing Yang, Yuwei Zheng. HONEY, I SHRUNK THE ATTACK SURFACE – ADVENTURES IN ANDROID SECURITY HARDENING by Nick Kralevich. DEFEATING SAMSUNG KNOX WITH ZERO PRIVILEGE by Di Shen. BLUE PILL FOR YOUR PHONE by Oleksandr Bazhaniuk, Yuriy Bulygin. CLOAK & DAGGER: FROM TWO PERMISSIONS TO COMPLETE CONTROL OF THE UI FEEDBACK LOOP by Chenxiong Qian, Simon Pak Ho Chung, Wenke Lee, Yanick Fratantonio.Black Hat and Defcon have a really good number of mobile related talks this year.
Defcon Las Vegas. Jailbreaking Apple Watch by Max Bazaliy. Inside the "Meet Desai" Attack: Defending Distributed Targets from Distributed Attacks by CINCVolFLT (Trey Forgety). macOS/iOS Kernel Debugging and Heap Feng Shui by Min(Spark) Zheng & Xiangyu Liu. Using GPS Spoofing to Control Time by David "Karit" Robinson. Phone System Testing and Other Fun Tricks by "Snide" Owen. Unboxing Android: Everything You Wanted To Know About Android Packers by Avi Bashan & Slava Makkaveev. Ghost in the Droid: Possessing Android Applications with ParaSpectre by chaosdata. Ghost Telephonist' Impersonates You Through LTE CSFB by Yuwei Zheng & Lin Huang. Bypassing Android Password Manager Apps Without Root by Stephan Huber & Siegfried Rasthofer. Man in the NFC by Haoqi Shan & Jian Yuan.
USENIX Workshop on Offensive Technologies (WOOT) Vancouver Canada, 14-15 August. Shattered Trust: When Replacement Smartphone Components Attack by Omer Shwartz, Amir Cohen, Asaf Shabtai, and Yossi Oren. White-Stingray: Evaluating IMSI Catchers Detection Applications by Shinjo Park and Altaf Shaik, Ravishankar Borgaonkar, Andrew Marti, Jean-Pierre Seifert. fastboot oem vuln by Roee Hay.
It was a busy month and July will be even busier. I'll be at GSMA DSG, Black Hat and Defcon July and Usenix WOOT in mid August
OEM just told Google a bug I submitted isn't a bug. It is a FULL permement secureboot bypass.— Jon Sawyer (@jcase) July 6, 2017
Picture of month:
Liang Chen is demostrating iOS 11.0 beta 2 jailbreak on iPhone 7. pic.twitter.com/wA7U9AQ32E— vangelis (@vangelis_at_POC) June 23, 2017
There is a lot happening in the Android boot loader world at the moment. I guess this is what happens when the devices get more and more locked down - people go after the root of trust.
Emulation and Exploration of BCM WiFi Frame Parsing using LuaQEMU
New attack can now decrypt satellite phone calls in "real time"
Library injection for debuggable Android apps
Attack TrustZone with Rowhammer
All slides from MOSEC 2017
Researchers Build Firewall to Deflect SS7 Attacks
Android Security Bulletin - July 2017
mobile CTF by HackerOne
Secure Mobile Application Development
ANDROID O AND DEX 38: DALVIK OPCODES FOR DYNAMIC INVOCATION
IMSecure - Attacking VoLTE (and other Stuff)
Telecom Signaling Exploitation Framework - SS7, GTP, Diameter & SIP
Thieves caught hours after stealing GPS tracking devices from tech company
How the Osmocom GSM stack is funded
OWASP list of the most important security tools for Android and iOS
For $500, this site promises the power to track a phone and intercept its texts
A recopilatory of useful android tools
Privacy Threats through Ultrasonic Side Channels on Mobile Devices (paper)
Subscribers remote geolocation and tracking using 4G VoLTE enabled Android phone (paper)
Breaking and Fixing VoLTE: Exploiting Hidden Data Channels and Mis-implementations (paper)
Dvmap: the first Android malware with code injection
JNI method enumeration in ELF files
root shell on Moto G4 & G5 with a Secure Boot and Device Locking Bypass
Breaking Samsung Galaxy Secure Boot through Downloaded mode (paper)
A very minimalist smali emulator that could be used to "decrypt" obfuscated strings
anti vm on android
Back That App Up: Gaining Root on the Lenovo Vibe
PoCs for Android July bulletin: CVE-2017-8260 CVE-2017-0705 CVE-2017-8259
Secure initialization of TEEs: when secure boot falls short
Reverse Engineering Samsung S6 SBOOT - Part II
No permission required for SMS verification in Android O
Black Hat USA July 26-27 Las Vegas. 'GHOST TELEPHONIST' LINK HIJACK EXPLOITATIONS IN 4G LTE CS FALLBACK by Haoqi Shan, Jun Li, Lin Huang, Qing Yang, Yuwei Zheng. ALL YOUR SMS & CONTACTS BELONG TO ADUPS & OTHERS by Angelos Stavrou, Azzedine Benameur, Ryan Johnson. BROADPWN: REMOTELY COMPROMISING ANDROID AND IOS VIA A BUG IN BROADCOM'S WI-FI CHIPSETS by Nitay Artenstein. CLOAK & DAGGER: FROM TWO PERMISSIONS TO COMPLETE CONTROL OF THE UI FEEDBACK LOOP by Chenxiong Qian, Simon Pak Ho Chung, Wenke Lee, Yanick Fratantonio. DEFEATING SAMSUNG KNOX WITH ZERO PRIVILEGE by Di Shen. FIGHTING TARGETED MALWARE IN THE MOBILE ECOSYSTEM by Andrew Blaich, Megan Ruthven. HONEY, I SHRUNK THE ATTACK SURFACE – ADVENTURES IN ANDROID SECURITY HARDENING by Nick Kralevich. NEW ADVENTURES IN SPYING 3G AND 4G USERS: LOCATE, TRACK & MONITOR by Altaf Shaik, Andrew Martin, Jean-Pierre Seifert, Lucca Hirschi, Ravishankar Borgaonkar, Shinjo Park. SONIC GUN TO SMART DEVICES: YOUR DEVICES LOSE CONTROL UNDER ULTRASOUND/SOUND by Aimin Pan, Bo Yang, Shangyuan LI, Wang Kang, Zhengbo Wang. SS7 ATTACKER HEAVEN TURNS INTO RIOT: HOW TO MAKE NATION-STATE AND INTELLIGENCE ATTACKERS' LIVES MUCH HARDER ON MOBILE NETWORKS by Martin Kacer, Philippe Langlois. THE FUTURE OF APPLEPWN - HOW TO SAVE YOUR MONEY by Timur Yunusov.This took a long time again. It gets harder and harder do to this since this stuff is not directly what I do on a day to day basis currently.
(Black Hat has a very strong mobile security line up this year.)
Defcon July 27-30 Las Vegas. Man in the NFC by Haoqi Shan & Jian Yuan. (speaker selection not final)
MOSEC June, Shanghai added a bunch of talks (all mobile security related, obviously).
Recon June 16-18 Montreal, Canada. FreeCalypso: a fully liberated GSM baseband by Mychaela Falconia. Hacking Cell Phone Embedded Systems by Keegan Ryan.
The Qualcomm Mobile Security summit was excellent again! Fantastic talks and again I met a bunch of people I mostly knew from email and/or twitter or haven't seen in quite some time. This conference still is unparalleled!
I had a minute to play with the BlackBerry KeyOne and it feels like a super solid device. The screen is bigger then I thought it would be and this makes the device almost too big for my taste - but this is hard to say from playing with it for just a minute.
So iOS will finally support NDEF tags.
This talk is really interesting for anybody interested in mobile application security. This is not about mobile app reverse engineering but about app, backend, phone infrastructure interaction.
Detect NFC tags on iOS 11.0! pic.twitter.com/70szXo1yny— Aaron (@iosaaron) June 5, 2017
Some old PalmOS devices on street in my hood <3 pic.twitter.com/gkePP0Uzd8— Collin Mulliner (@collinrm) May 28, 2017
Papers and Slides from MOBILE SECURITY TECHNOLOGIES (MOST) 2017 an Academic Workshop
Android Security Bulletin - June 2017
LazyDroid - bash script to facilitate some aspects of an Android application assessment
factory and OTA images for Nexus devices
Android: Multiple Android devices do not revoke QSEE trustlets
Brazilian phishers are now asking for victim's IMEI in their fake bank pages, aiming to steal their accounts via mobile access
50+ iOS 11 Features Apple Didn't Announce On Stage [List]
Android Mazar 3.0 targets 41 banking apps
Google Publishes List of 42 Phones Running Latest Android Security Updates 42 is not a lot!
City-Wide IMSI-Catcher Detection
Up to $200,000 for Android exploits!
Mobile subscriber WiFi privacy (WiFi IMSI catcher!!) (paper)
Collection of the most common vulnerabilities found in iOS applications
Android O feature spotlight: Android tells you if an app is displaying a screen overlay
Priorities for Securing the Mobile Ecosystem (slides)
Cloak & Dagger Android Overlay attacks
Cloak & Dagger (slides)
Cloak & Dagger talk(youtube)
Honey, I Shrunk the Attack Surface Adventures in Android Security Hardening (slides)
With great speed comes great leakage - How processor performance is tied to side-channel leakage (slides)
Pwning the Nexus of Every Pixel (slides)
initroot: Bypassing Nexus 6 Secure Boot through Kernel Command-line Injection
Android Encryption Demystified
iPhone 7 and 7 Plus get a stable jailbreak on iOS 10.1.1 with extra_recipe+yaluX
The Shadow over Android (slides)
Apparently Google Play Store can now manage your app signing keys, and 'opt-in is permanent (via Nikolay Elenkov)
Hacking iOS Applications a detailed testing guide (doc)
Android malware that infected 3500 devices/day
iOS/macOS bugs slaughter list by P0's Ian Beer
Hacking the Samsung Galaxy S8 Irisscanner
Learning about Bluetooth protocols and reverse-engineering them.
A Simple Tool for Linux Kernel Audits
Google VS Root: Why SafetyNet is now standard for developers
Google Play can now restrict app distribution based on SafetyNet Attestation results, SoC vendor etc (via John Kozyrakis)
US Senate Adopts Signal, HTTPS A Year After Trying To Kill Encryption
Alarming Security Defects in SS7, the Global Cellular Network - and How to Fix Them
iOS Kernel utilities
Dutch Cops Bust Another PGP BlackBerry Company for Alleged Money Laundering
Multiple MediaTek vulnerabilities
Google Working on Fix for Android Permission Weakness
More Android phones than ever are covertly listening for inaudible sounds in ads
The Jiu-Jitsu of Detecting Frida
Thieves drain 2fa-protected bank accounts by abusing SS7 routing protocol
Over 100 CF-Auto-Roots were updated by ChainfireXDA
Android Security Bulletin - May 2017
de-obfuscate Android Ztorg obfuscated strings
Android Applications Reversing 101
A diagram of the Android Activity / Fragment lifecycle
Example of a powerful overlay attack executed by Android banker (video)
Identifying an Android Device - Available Identifiers
Diving Deeper into Android O
How To Put Any Android Smartphone Into Monitor Mode Using Custom Script Without bcmon
Android app analysis and feature extraction library
Introduction to Fridump
Here's How To Track The Smartphone Apps That Are Tracking You
AssetHook: A Redirector for Android Asset Files Using Old Dogs and Modern Tricks
Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)
The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration testing topics.
TruSpy: Cache Side-Channel Information Leakage from the Secure World on ARM Devices (paper)
Dirty COW and why lying is bad even if you are the Linux kernel
How to build and integrate OpenSSL into your Android NDK project
iOS DeviceCheck. Access per-device, per-developer data that your associated server can use in its business logic.
Changes to Trusted Certificate Authorities in Android Nougat
Qualcomm Mobile Security Summit 2017 San Diego, May. All talks are on mobile security - super strong lineup!
AppSec EU May 11-12, Belfast. How to steal mobile wallet? - Mobile contactless payments apps attack and defense. Fixing Mobile AppSec: The OWASP Mobile Project.
MOSEC June Shanghai. Pwning Apple Watch. (program not complete yet!)
OffensiveCon is a new security conference in Berlin Germany focused on Offense. No details yet but they chose the right location for sure.
For everybody who didn't make it to the Android Security Symposium, they recorded the talks and the videos are available: here.
Google published a blog post and a detailed report on Android Security in 2016. The report covers everything from patching and update stats to high impact vulnerabilities. People posted a lot of summaries but you should really read it yourself if you work with Android.
Google pulls March security update for Nexus 6, after it breaks SafetyNet and Android Pay. This was pretty interesting, not the fact that they broke SafetyNet but that they broke it for their own devices (Nexus). This happened to some really small manufacturer before and if you have an idea of how SN works on the backend - it is clear what happened.
execute USSD codes in iOS 10.2.xx --bug-Impact: Tapping a tel link in a PDF document could trigger a call without prompting the user #lol— Ravishankar Borgaonk (@raviborgaonkar) March 27, 2017
Android anti-debugging tricks can be patented? This is stupid in so many ways https://t.co/IjXfg45xoN— Bernhard Mueller (@muellerberndt) March 25, 2017
Anti Debugging fun Android Art
PageSwitch an exploit toolkit for the Nintendo switch
Ransomware scammers exploited Safari bug to extort porn-viewing iOS users
Increasing Android app security for freei (slides)
Looking Back at Android Security in 2016 by DuoSecurity
OWASP Mobile - Anti Reversing Checks
Android/Ztorg teardown - It detects the Android SDK emulator, but also emulators from Genymotion, Bluestacks and BuilDroid. It also detects tainted environments. Several of its checks will be difficult to bypass
Owning OnePlus 3/3T with a Malicious Charger
The updated iOS Security Guide now covers iOS 10
iOS 10.3 fixes a large number of Kernel and WebKit bugs
Statistical Deobfuscation for Android (I suppose this is for Dex code only)
Hacking Android Apps with Frida (part 2)
Nexus 5X Owners Say Device Boot-Looping Kills Phones; Getting Runaround From LG
This American Surveillance Tool Helped Russians Spy On Androids And iPhones
Apple cracking down on developers who use SDKs like Rollout to update apps without App Store approval (Apple going after hot-patching frameworks)
Attacking Nexus 9 with Malicious Headphones
GSMA Coordinated Vulnerability Disclosure Program
gdrive-appdata: Tries to fetch the contents of the appdata hidden folder from Google Drive.
Harald Welte about TelcoSecDay 2017 @ Troopers
NDK changes for API level 26
O-MG, the Developer Preview of Android O is here!
Android API Differences Report
Frustrated by robo callers & an AT&T subscriber? Get the AT&T call protect app
Samsung commits to monthly security updates for unlocked US smartphones
Android phone market stats
20 bestselling mobile phones of all time
Android Kernel CVE PoCs
Mobile Malware Masquerades as POS Management App
Judge an Android malware scanner by rednaga.io (@timstrazz and @caleb_fenton)
The Art Of Bootloader Unlocking: Exploiting Samsung S-Boot (video from nullcon talk)
Having fun with Secure Messengers and Android Weari (slides CansecWest 2017)
Pwning the NExus of Every Pixel (slides CanSecWest 2017)
Injecting Metasploit Payloads into Android Applications
Receive FREE SMS online (number in various countries)
TrustZone An Attackers Perspective (slides)
Reverse Engineering Samsung S6 SBOOT - Part I
Letter to the FCC on SS7 Security by Ron Wyden
FCC: Legacy Systems Risk Reductions (it's about ss7)
Black Hat ASIA Singapore March 28-31. FRIED APPLES: JAILBREAK DIY by Alex Hude, Max Bazaliy, Vlad Putin. ANTI-PLUGIN: DON'T LET YOUR APP PLAY AS AN ANDROID PLUGIN by Cong Zheng, Tongbo Luo, Xin Ouyang, Zhi Xu. REMOTELY COMPROMISING IOS VIA WI-FI AND ESCAPING THE SANDBOX by Marco Grassi. 3G/4G INTRANET SCANNING AND ITS APPLICATION ON THE WORMHOLE VULNERABILITY by Guangdong Bai, Zhang Qing. MOBILE-TELEPHONY THREATS IN ASIA by Lion Gu, Marco Balduzzi, Payas Gupta. MASHABLE: MOBILE APPLICATIONS OF SECRET HANDSHAKES OVER BLUETOOTH LE by Yan Michalevsky.
CanSecWest Vancouver Canada, March 15-17. Qidan He : Pwning Nexus of Every Pixel: Chain of Bugs demystified. Logic Bug Hunting in Chrome on Android by Georgi Hershey & Robert Miller.
Zer0Con Seoul, Korea April 13-14. Ian Beer : Through the mach portal.
OsmoCon (Osmocom Conference) 2017 is the first technical conference for Osmocom users, operators and developers! April 21, Berlin. All about Osmocom!
HITB Amsterdam April 13-14. FEMTOCELL HACKING: FROM ZERO TO ZERO DAY by JeongHoon Shin. CAN'T TOUCH THIS: CLONING ANY ANDROID HCE CONTACTLESS CARD by Slawomir Jasek. EXTRACTING ALL YOUR SECRETS: VULNERABILITIES IN ANDROID PASSWORD MANAGERS by Stephan Huber, Steven Artz, Siegfried Rasthofer. HUNTING FOR VULNERABILITIES IN SIGNAL by Markus Vervier.
Opcde Dubai, UAE April 26-27. Practical attacks against Digital Wallet by Loic Falletta.
I took a way too long break again. So many things happen in the world of mobile security every week. I really wish I had more time for this. I also have a bunch of small things I need to put on this blog but I think they are too specific for the news and will likely get their own posts.
Some news from MWC (I didn't attend):
First the BlackBerry KEYone a new Android-based phone with a physical keyboard. Other then the BB Priv the KEYone's keyboard is fix and doesn't slide. Movable parts are really not a good idea, they break way too fast. In my opinion this device looks super solid and likely will be supported longer than the average flagship phone from other manufacturers (data on this would be awesome).
Nokia released 3 new Android phones the 3 (MTK), 5 (QCOM) and 6 (QCOM). The phones seem to run Android N without any modifications or vendor crap. Very low price (230Euro for the 6). The bottom of their website specifically says: You get an experience that's focused and clutter-free, and we'll make sure you keep getting regular updates, so you'll always stay on top of features and security. that is what you should expect in 2017.
The Android Devices Security Patch Status page is an awesome resource to determine if a specific device from a specific vendor has been patched and when the patch was released. From the page: This list is Prepared to Serve as a Quick reference to identify which Device is being actively maintained by the Vendor.. This is super useful, thanks!
Xiaomi launching own SoC for Android phones-upgradable baseband with fake base station detection capabilities. IMSI catchers r threat now ;) pic.twitter.com/S0hzDBIiQd— Ravishankar Borgaonk (@raviborgaonkar) March 2, 2017
Apple 0day is expensive. https://t.co/F1UEUU0s3r— Collin Mulliner (@collinrm) February 22, 2017
MOSEC mobile security conference in June in Shanghai. This seems to be the 3rd year of the conference. There is no schedule yet.
The story of the day Vault 7: CIA Hacking Tools Revealed. Vault 7: CIA Hacking Tools Revealed : iOS Exploit list. Yes, the CIA uses n-day exploits! The Android exploits.
They talk about Android, Defcon, and backdooring your repo? ;-)
Pic of the month:
ENISA: Smartphone Secure Development Guidelines
Android Security Bulletin - March 2017
Android Security Bulletin - February 2017
Vault 7: CIA Hacking Tools Revealed
Multi-BTS with Osmocom and a single UmTRX
Obfuscation-Resilient Privacy Leak Detection for Mobile Apps Through Differential Analysis Paper and Tool
Booting into fastboot mode Instructions for all Nexus devices
TROOPERS17 GSM Network - How about your own SMPP Service?
MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models paper
Exploiting Android S-Boot: Getting Arbitrary Code Exec in the Samsung Bootloader (1/2)
Android ransomware requires victim to speak unlock code
Hacking Android phone. How deep the rabbit hole goes.
Sunny with a chance of stolen credentials: Malicious weather app found on Google Play 5k installs via Google Play!
iOS keychain items used to persist after app uninstall. As of iOS 10.3 beta 2, deleting app deletes keychain items via @hubert3
SunShine 3.4.27 is out - Bringing unlock support for Droid Turbo on 6.0.x
Cellular re-broadcast over satellite
Identifying Rebroadcast (GSM) also linked in post above
ios-triage - Node.js cli for iOS incident response. Program will extract, process and report (including diffs) on iOS device and app telemetry.
Remote control: Companies blur lines over who owns devices
Shodan.io iOS App
Analysis of iOS.GuiInject Adware Library
Patching and Re-Signing iOS Apps
Lifting the (Hyper) Visor: Bypassing Samsung's Real-Time Kernel Protection
Android ransomware repurposes old dropper techniques
Deobfuscating libMobileGestalt keys
Samsung: Stack buffer overflow in OTP TrustZone trustlet
How easy it would be to hack Trump's phone by my friend Zach aka @quine
iOS 10.2 Yalu Jailbreak Now Supports All 64-bit Devices except iPhone 7 and iPad Air 2
Android bootloader (aboot) parser
Tracking Android Security Update across Devices
SAMSUNG KNOX 1.0 ECRYPTFS KEY GENERATOR WEAK ENCRYPTION
Deep Analysis of Android Rootnik Malware Using Advanced Anti-Debug and Anti-Hook, Part II: Analysis of The Scope of Java
Black market Blackphones get sent a kill message that bricks them
iOS/MacOS kernel memory corruption due to userspace pointer being used as a length
Update on the Fancy Bear Android malware (poprd30.apk)
An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps (paper)
Charger Malware Calls and Raises the Risk on Google Play
Secrets leak in Android apps online service to test APKs
26 security issues in major Android password manager apps
Easy 4G/LTE IMSI Catchers for Non-Programmers (paper)
App-in-the-Middle Attack Bypasses Android for Work Secure Framework
Android FRIDA: Add support for enumerateLoadedClasses() on ART
Android: Inter-process munmap in android.util.MemoryIntArray
Owning a Locked OnePlus 3/3T: Bootloader Vulnerabilities
Binary based obfuscation in a way of CTF kids. We obfuscate your apps, support both iOS/Android.
Android (Huawei) privilege escalation in EMUI keyguard app via loading shellcode in theme pack
The Story of Firefox OS
33c3 Hamburg, Germany 27-30 December. Downgrading iOS: From past to present by tihmstar. A look into the Mobile Messaging Black Box by Roland Schilling and Frieder Steinmetz. Dissecting modern (3G/4G) cellular modems by LaForge and holger. Geoloation methods in mobile networks by Erik.
Shmoocon Washington D.C. January. A Context-Aware Kernel IPC Firewall for Android - David Wu, Sergey Bratus.
Black Hat ASIA March 2017. FRIED APPLES: JAILBREAK DIY by Alex Hude and Max Bazaliy. MASHABLE: MOBILE APPLICATIONS OF SECRET HANDSHAKES OVER BLUETOOTH LE by Yan Michalevsky. REMOTELY COMPROMISING IOS VIA WI-FI AND ESCAPING THE SANDBOX by Marco Grassi.
I had to skip the November update due to a long overdue vacation. Playing with iOS webviews also did cost some time. Writing this blog becomes more and more time consuming since for some parts I would rather spent time on research than writing about other peoples research. Will see next year if I continue doing this or not. I'm doing this since January 2009 so it has been a few years.
Opcde ConferenceSamsung confirms it will render the US Note 7 useless with next update since the owners don't seem to care to return the phones to Samsung even tho they would get a replacement device. This is kind of hilarious.
Browser based iOS 9.3.x jailbreak (64bit only) it has been a while.
Chinese company installed secret backdoor on hundreds of thousands of phones
Here is the BLU R1 blind system command execution via Adups from July of this year - anyone think they care? pic.twitter.com/veUMGD8zSy— Tim Strazzere (@timstrazz) November 22, 2016
Recently the topic of SMS 2FA came up again. While I agree that SMS is not the most secure version of 2FA it is far far better then not providing any 2FA mechanism for your service.
Seems like the right ordering, but when deployment is 98% < 2% < .5% < .01% complaining about SMS security is pretty silly. https://t.co/5ex3naa5a5— Alex Stamos (@alexstamos) December 1, 2016
Oxygen 9.0.3 allows to brute force a passcode for any Windows Phone 8 device from its physical dump!
Android system_server Code Loading Bypass
"Root" via dirtyc0w privilege escalation exploit (automation script) / Android (32 bit) Raw
Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systems (paper)
JTAGing Mobile Phones (from August)
The limitations of Android N Encryption
The fight against Ghost Push continues
BitUnmap: Attacking Android Ashmem
Saving Data: Reducing the size of App Updates by 65% (looks interesting)
More Than 1 Million Google Accounts Breached by Gooligan
Telstra is switching off their GSM network
Qualcomm has a Bug Bounty now
Nintendo has a Bug Bounty now
Secure Rom extraction on iPhone 6s
Android Security Bulletin - December 2016
HackingTeam back for your Androids, now extra insecure!
SunShine 3.4.18 has been released. Bring Support for Android 7.x.x and latest HTC 10 updates
A detailed security assessment on Android Full Disk Encryption (paper)
BitUnmap: Attacking Android Ashmem
Fuzzing Android OMX (slides)
Anonymous web-based SMS
Mobile Network Codes (MNC) for the international identification plan for public networks and subscriptions (According to Recommendation ITU-T E.212 (09/2016))
Call me maybe: Exploiting iOS WebViews to force automatic FaceTime calls
Android Banking Malware Masquerading as Email App Targets German Banks
Second Chinese Firm in a Week Found Hiding Backdoor in Firmware of Android Devices
Powerful backdoor/rootkit found preinstalled on 3 million Android phones
RAGENTEK ANDROID OTA UPDATE MECHANISM VULNERABLE TO MITM ATTACK
New Reliable Android Kernel Root Exploitation Techniques (slides)
Analysis of iOS.GuiInject Adware Library
Android Security Bulletin - November 2016
HelDroid: Dissect Android Apps Looking for Ransomware Functionalities
Rooting Every Android From Extension To Exploitation by Di Shen (slides)
Mobile Espionage in the Wild Pegasus and Nation-State Level Attacks (slides)
The Android Security Center
Technical Analysis of the Pegasus Exploits on iOS (paper)
Just a place to dump the cdma data I collected while at Defcon 2016
CRiOS: Toward Large-Scale iOS Application Analysis (paper)
Exploring LTE security and protocol exploits with open source software and low-cost software radio by Roger Jover (slides)
Your smartphone is a civil rights issue (TED talk)
Receive SMS Online
Android wear MiTM
*droid: Assessment and Evaluation of Android Application Analysis Tools (paper)
Using Google Fi on an iPhone
iOS WebView auto dialer bug
TL;DR: iOS WebViews can be used to automatically call an attacker controlled phone number. The attack can block the phone's UI for a short amount of time and therefore prevent the victim from canceling the call. The bug is an application bug that likely is due to bad OS/framework defaults. One major issue with this vulnerability is that it is really easy to exploit. App developers have to fix their code as soon as possible. The Twitter and LinkedIn iOS apps are vulnerable (other apps might be vulnerable too). Demo videos here: Twitter and LinkedIn (embedded videos are below on this page).
About a week ago (on a Friday) I read an news post [1,2] about a guy who got arrested for accidentally DoSing 911 by creating a web page that automatically dialed 911 when visited it from an iPhone. This was most likely due to a bug with the handling of TEL URI [4,5]. I immediately thought about a bug I reported to Apple in late October 2008 . I couldn't believe this bug has resurfaced so I investigated. The article said something about posting links on Twitter.
On Nov. 6th I updated the bug report to Twitter to add the UI blocking issue (continue reading) and uploaded a video. Today Twitter simply closes the bug as a duplicate without any comment. While this might be a simple duplicate they should have an interest in playing nice and being thankful to those who report bugs they find in their spare time. Because of this action I decided to post the full details of the issue today.
During the weekend I took some time to further investigate the issue. I determined that this might be a general issue with iOS apps the use WebViews to display content. I tested a few popular apps I had installed. Vulnerable apps need a way for users to post web links that will be opened in a WebView inside the app itself. Apps that open links in mobile Safari or Chrome would not be vulnerable (I tested this). One app I tested fairly early was the LinkedIn app since LinkedIn basically is social media for the business context. People can send messages and post updates. Updates usually are text and link. I posted a link and clicked it and yes it dialed my other phone (demo video below).
I wanted to submit the bug to LinkedIn and found that they have a bug bounty program. Unfortunately it was a private bounty and you would only be added if you previously submitted bugs. I tried to get around it but it didn't work. After some thinking I decided to not report it to LinkedIn privately but openly (parallel to this blog post). It is 2016 after all and if they don't want to add me to their program that is their choice. In general I will likely not report bugs outside of a bug bounty program if a private bug bounty program exists.
Another weekend comes I have some time and started playing with the bug again. Actually I started looking at my PoC from 2008 while trying to figure out if I report the bug to LinkedIn or not. After playing around for a bit I more or less get my old PoC working with the Twitter and LinkedIn apps. WOW!
Taking one step backwards. The original bug I reported to Twitter was triggering a phone call by visiting a website that redirect to a TEL URL. One could do this with various techniques such as: http-meta refresh, iframe, setting document.location, window.location, or an HTTP redirect (Location header). This would simply dial a number. The victim would see the dialer and the target number on the screen and of course could just cancel the call by pressing the big red button. Just causing the call is already bad since an unobservant person will be baffled (why is my phone dialing some number).
The beauty of my 2008 bug was that I could block the phone's UI for a few seconds and therefore prevent the user from canceling the call. I managed to abuse exactly the same trick to block the UI that I used in 2008. The trick is to cause the OS to open a second application while the phone is dialing the given number. Opening applications is pretty straight forward, you open a URL that causes the OS to spawn another application. This can be anything from the messages app (via the SMS: URL) or iTunes (via the itms-apps: URL). You can pretty much get any application to launch that has a URI binding. In 2008 I used a SMS URL with a really really long phone number to block the UI thread. My best guess on how this works is that the IPC subsystem actually has difficulties to move several kilobytes of URL data through the various layers into the app and the target app might also not be super happy about really large URLs. I ended-up with the code below. The code uses the combination of meta-refresh tag and window.location to execute the attack. The codes delays setting the window.location by 1.3 seconds to guarantee that the dialer is executed first. The delay cannot be too long otherwise the WebView will not execute the URL handler for launching the messages app. Basically you have to get the timing just right.
The PoC to trigger this bug.
Below two video demonstrations of this attack. You can clearly see that the UI is not responsive for a short amount of time. The time is long enough to make somebody pickup on the other side (especially service hot lines automatically pickup).
Normal good app behavior:
Apps should normally check the URL schema before executing it and show the user a pop-up dialog before executing an app on the device. Some examples are shown below:
Mobile Safari asking before calling the Apple Support number. This is how good apps should behave!
Dropbox showing a warning but not showing the target number. Ok but could be better.
The Yelp app normally behaves like Safari but if you hit it with an HTTP redirect it does not show the target number. I just included this for the fun of it.
App developers should review their use of WebViews to determine if they are vulnerable to this attack. Vulnerable apps need to be fixed. Service providers like Twitter and LinkedIn can inspect links posted to their sites for containing malicious code and prevent those links from being posted to their service.
Apple should change the default behavior of WebViews to exclude execution of TEL URIs and make it an explicit feature to avoid this kind of issues in the future. I reported this issue to Apple.
 Bug Bounty Hunter Launches Accidental DDoS Attack on 911 Systems via iOS Bug (softpedia)
 iPhone hack that threatened emergency 911 system lands teen in jail (ars technica)
 Here my post to full-disclosure in Nov. 2008 after Apple fixed the bug in iOS 3.0 : iPhone Safari phone-auto-dial vulnerability (original date: Nov. 2008)
 Original TEL URI schema RFC2806 URLs for Telephone Calls
 Updated TEL URI schema RFC3966 The tel URI for Telephone Numbers