Changes to how data is encrypted can help developers ward off data leakage and exfiltration.
Link: https://threatpost.com/google-android-key-security/139906/
Tag: Mobile Security
Android Trojan Targets PayPal Users
The trojan purports to be a battery optimization app – and then steals up to 1,000 euro from victims’ PayPal accounts.
Link: https://threatpost.com/android-trojan-targets-paypal-users/139872/
Jackhammer – One Security Vulnerability Assessment/Management Tool To Solve All The Security Team Problems
One Security vulnerability assessment/management tool to solve all the security team problems.What is Jackhammer?Jackhammer is a collaboration tool built with an aim of bridging the gap between Security team vs dev team, QA team and being a facilitator for TPM to understand and track the quality of the code going into production. It could do static code analysis and dynamic analysis with inbuilt vulnerability management capability. It finds security vulnerabilities in the target applications and it helps security teams to manage the chaos in this new age of continuous integration and continuous/multiple deployments.It completely works on RBAC (Role Based Access Control). There are cool dashboards for individual scans and team scans giving ample flexibility to collaborate with different teams. It is totally built on pluggable architecture which can be integrated with any open source/commercial tool.Jackhammer uses the OWASP pipeline project to run multiple open source and commercial tools against your code,web app, mobile app, cms (wordpress), network.Key Features:Provides unified interface to collaborate on findingsScanning (code) can be done for all code management repositoriesScheduling of scans based on intervals # daily, weekly, monthlyAdvanced false positive filteringPublish vulnerabilities to bug tracking systemsKeep a tab on statistics and vulnerability trends in your applicationsIntegrates with majority of open source and commercial scanning toolsUsers and Roles management giving greater controlConfigurable severity levels on list of findings across the applicationsBuilt-in vulnerability status progressionEasy to use filters to review targeted sets from tons of vulnerabilitiesAsynchronous scanning (via sidekiq) that scaleSeamless Vulnerability ManagementTrack statistics and graph security trends in your applicationsEasily integrates with a variety of open source, commercial and custom scanning toolsSupported Vulnerability Scanners:Static Analysis:BrakemanBundler-AuditCheckmarx**DawnscannerFindSecurityBugsXanitizer*NodeSecurityProjectPMDRetire.js * license required ** commercial license requiredFinding hard coded secrets/tokens/creds:Trufflehog (Slightly modified/extended for better result and integration as of May 2017)Webapp:ArachniMobile App:Androbugs (Slightly modified/extended for better result and integration as of May 2017)Androguard (Slightly modified/extended for better result and integration as of May 2017)Wordpress:WPScan (Slightly modified/extended for better result and integration as of May 2017)Network:NmapAdding Custom (other open source/commercial /personal) Scanners:You can add any scanner to jackhammer within 10-30 minutes. Check the links/video Quick Start and InstallationSee our Quick Start/Installation Guide if you want to try out Jackhammer as quickly as possible using Docker Compose.Run the following commands for local setup (corporate mode): git clone https://github.com/olacabs/jackhammer sh ./docker-build.shDefault credentials for local setup:username: jackhammer@olacabs.compassword: j4ckh4mm3r(For single user mode)sh ./docker-build.sh SingleUserdo signup for accessRestarting Jackhammerdocker-compose stopdocker-compose rmdocker-compose up -dUser GuideThe User Guide will give you an overview of how to use Jackhammer once you have things up and running.DemoDemo Environment Link:https://jch.olacabs.com/Default credentials:username: admin@admin.compassword: admin@admin.comCreditsSentinels Team @OlaShout-out to:-Madhu-Habi-Krishna-Shreyas-Krutarth-Naveen-MohanDownload Jackhammer
Google Patches 11 Critical RCE Android Vulnerabilities
Google’s December Android Security Bulletin tackles 53 unique flaws.
Link: https://threatpost.com/google-patches-11-critical-rce-android-vulnerabilities/139612/
U.S. Military Members Catfished and Hooked for Thousands of Dollars
Prisoners in South Carolina posed convincingly as beautiful women on social media platforms.
Link: https://threatpost.com/u-s-military-members-catfished-and-hooked-for-thousands-of-dollars/139569/
iOS Fitness Apps Robbing Money From Apple Victims
The two apps, “Fitness Balance App” and “Calories Tracker app,” were tricking users into payments of $120.
Link: https://threatpost.com/ios-fitness-apps-robbing-money-from-apple-victims/139546/
Pegasus Spyware Targets Investigative Journalists in Mexico
Colleagues of slain Javier Valdez Cárdenas, known for investigating drug cartels, were targeted just days after his death.
Link: https://threatpost.com/pegasus-spyware-targets-investigative-journalists-in-mexico/139424/
Cheetah Mobile Blames SDKs for Rampant Ad Fraud in Its Android Apps
Eight popular Android apps are embezzling from the ad ecosystem on a widespread basis, according to allegations.
Link: https://threatpost.com/cheetah-mobile-blames-sdks-for-rampant-ad-fraud-in-its-android-apps/139415/
Mobile Rotexy Malware Touts Ransomware, Banking Trojan Functions
A mobile malware has accelerated its activity in 2018, launching more than 70k attacks in August through October.
Link: https://threatpost.com/mobile-rotexy-malware-touts-ransomware-banking-trojan-functions/139350/
User Confidence in Smartphone Security Abysmal
Sixty-six of percent of phone users said they had suffered data-related harm: 11 percent suffered identity theft, 22 percent account hacking, 14 percent credit cards hacking and 12 percent financial fraud.
Link: https://threatpost.com/user-confidence-in-smartphone-security-abysmal/139349/