ad

Exclusive Updates from 'Rafay Hacking Articles'

Newsletter

Executive Brief: eCommerce Analytics

In the era of the empowered shopper, the effective use of data is what makes the difference between success and failure in eCommerce programs. Click here to download
[Sponsored]

Latest News Mar 31, 2015

Android Browser Kitkat Content Spoofing Vulnerability


The following is a low risk vulnerability that was found few months ago while testing the latest Android Stock browser on Android Kitkat. The issue that was found is commonly referred as Content spoofing Vulnerability or dialog box spoofing vulnerability which could be used to fake an alert message on a legitimate website. ...

Android Browser Cross Scheme Data Exposure + Intent Scheme Attack


tl;dr This exploit is an issue present in Android browser < 4.4 and several other android browsers which allows an attacker to read sqlite cookie database file and hence exposing all cookies. Along with it we also talk about a Cross Scheme Data exposure attack in Android < 4.4. ...

Bad Meets evil - PHP meets Regular Expressions

twi

This article would briefly discuss the reason why Regular Expressions might not be suitable for filtersand how things could turn miserably bad when PHP comes is used with Regular Expressions. The post would then continue with the write-up of a relevant scenario based challenge, and finally will conclude with the author's opinion on the topic. ...

Common Attacks Against Modems

0x01: Introduction to Modems

The term DSL modem is technically used to describe "a modem which connects to a single computer, through a USB port or is installed in a computer PCI slot". The more common DSL router which combines the function of a DSL modem and a home router is a standalone device which could be connected to multiple computers through multiple Ethernet ports or an integral wireless access point. Also called as a "residential gateway", a DSL router usually manages the connection and sharing of the DSL service in a home or small office network. ...

A Tale Of Another SOP Bypass In Android Browser < 4.4


Since, my recent android SOP bypass [CVE-2014-6041] triggered a lot of eruption among the infosec community, I was motivated to research a bit more upon the android browser, it turns out that things are much worse than I thought, I managed to trigger quite a few interesting vulnerabilities inside of Android browser, one of them being another Same Origin Policy Bypass vulnerability. The thing that makes it worse was the same SOP bypass was already ...

Best Practices for Making BYOD Simple and Secure

Discover how to select technologies and develop policies for your BYOD program. Click here to download
[Sponsored]

This email was sent to youbeeub.fbhacking123@blogger.com. You are receiving this newsletter because you opted-in to receive relevant communications from Rafay Hacking Articles. If you would like to manage your newsletter preferences, please click here.

Rafay Hacking Articles | Karachi, Pakistan 44000
Contact: rafayhackingarticles@gmail.com
Unsubscribe

The Hacking Articles

The Hacking Articles


Android Installer Hijacking vulnerability leaves apps open to malware

Posted: 30 Mar 2015 11:39 AM PDT

Palo Alto Networks discovered a widespread vulnerability in Google's Android OS.  The vulnerability mentioned  in a blog post released Tuesday, more than a year after initially discovering the bug and alerting Google and other Android manufacturers of its existence. Any attacks leveraging the bug rely on the fact that Android packages (APKs) downloaded through Google Play are installed to a protected space, whereas apps downloaded through a third-party store are saved to unprotected local storage.

Android at risk

To fall victim to an attack, a malicious application must be installed on a device. This app can come from either a legitimate or third-party app store and can function perfectly. However, written into the app is a code that allows it to detect when the compromised user is installing a new app, according to the post.

The malicious app will check whether the new app is being installed through a third-party store or Google Play, or, more simply, if it's being saved to a protected space or unprotected local storage, the post says.

If the app is going to be saved in an unprotected space, the malicious app begins taking action. At this point, it will overwrite the legitimate app with malware while a user views a permission page. More permissions could be provided than detailed in the permissions page, and the device becomes officially compromised.

The vulnerability affects Android 2.3, 4.0.3-4.0.4, 4.1.X, and 4.2.x. Android Open Source Project issued patches for Android 4.3 and later, dropping the vulnerability rate to 50 percent, Ryan Olson, Unit 42 intelligence director, Palo Alto Networks, said in an interview with SCMagazine.com.

No exploits had been spotted in the wild previous to this blog posting, Olson said, but he recommended that users only download from legitimate app stores.

"Generally, our guidance to any enterprise deploying Android is to keep it as locked down as possible," he said. "Don't allow sources other than Google Play to install apps on the phone."

The company also released a vulnerability scanner app through Google Play that can determine whether a device is vulnerable.

Stay Safe…

Exclusive Updates from 'Rafay Hacking Articles'

Newsletter

Powering the Hybrid Enterprise

Computing is no longer done in a single location. Users, applications, and data exist in more places than ever before, creating an unprecedented challenge for IT. Click here to download
[Sponsored]

Latest News Mar 26, 2015

Android Browser Kitkat Content Spoofing Vulnerability


The following is a low risk vulnerability that was found few months ago while testing the latest Android Stock browser on Android Kitkat. The issue that was found is commonly referred as Content spoofing Vulnerability or dialog box spoofing vulnerability which could be used to fake an alert message on a legitimate website. ...

Android Browser Cross Scheme Data Exposure + Intent Scheme Attack


tl;dr This exploit is an issue present in Android browser < 4.4 and several other android browsers which allows an attacker to read sqlite cookie database file and hence exposing all cookies. Along with it we also talk about a Cross Scheme Data exposure attack in Android < 4.4. ...

Bad Meets evil - PHP meets Regular Expressions

twi

This article would briefly discuss the reason why Regular Expressions might not be suitable for filtersand how things could turn miserably bad when PHP comes is used with Regular Expressions. The post would then continue with the write-up of a relevant scenario based challenge, and finally will conclude with the author's opinion on the topic. ...

Common Attacks Against Modems

0x01: Introduction to Modems

The term DSL modem is technically used to describe "a modem which connects to a single computer, through a USB port or is installed in a computer PCI slot". The more common DSL router which combines the function of a DSL modem and a home router is a standalone device which could be connected to multiple computers through multiple Ethernet ports or an integral wireless access point. Also called as a "residential gateway", a DSL router usually manages the connection and sharing of the DSL service in a home or small office network. ...

A Tale Of Another SOP Bypass In Android Browser < 4.4


Since, my recent android SOP bypass [CVE-2014-6041] triggered a lot of eruption among the infosec community, I was motivated to research a bit more upon the android browser, it turns out that things are much worse than I thought, I managed to trigger quite a few interesting vulnerabilities inside of Android browser, one of them being another Same Origin Policy Bypass vulnerability. The thing that makes it worse was the same SOP bypass was already ...

eCommerce Analytics: Optimize the Shopper's Journey

Now is the golden age of the customer: with a click or swipe on a device like a smartphone or tablet, shoppers today can access a wealth of information to find and buy the products or services that meet their needs. Click here to download
[Sponsored]

This email was sent to youbeeub.fbhacking123@blogger.com. You are receiving this newsletter because you opted-in to receive relevant communications from Rafay Hacking Articles. If you would like to manage your newsletter preferences, please click here.

Rafay Hacking Articles | Karachi, Pakistan 44000
Contact: rafayhackingarticles@gmail.com
Unsubscribe