Why hello there faithful #MobSec5 reader!
This week’s highlight reel of the mobile security news that matters includes:
- BootStomp and six zero-day vulnerabilities in Android bootloaders
- Android security update for September now available
- Dolphins attack Siri
Thanks for reading. Have a great weekend, be good, and stay safe.
Subscribe now to receive #MobSec5 updates each Friday in your inbox.
“Researchers find six previously-unknown memory corruption and unlock-bypass vulnerabilities in major chipset vendors’ firmware code.”
Android bootloader integrity directly affects the security of the device it runs on. So we took notice of these bootloader vulnerabilities and wrote up an Android bootloader security primer that discusses BootStomp, associated zero-day vulnerabilities, why they matter, and what organizations can do about it.
Android Security Bulletin—September 2017
(Android Open Source Project)
“The most severe of these issues is a critical severity vulnerability in media framework that could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of a privileged process.”
DIY Spy Program: Abusing Apple’s Call Relay Protocol
“Finding, exploiting and leveraging vulnerabilities in Apple’s Call Relay protocol to build a spy program. CVE: 2016-4635, 2016-4721, 2016-4722, 2016-7577.”
Convinced that because you use iOS you’re secure? Think again. Martin Vigo says “these vulnerabilities could be used to spy on a girlfriend, colleagues, roommates or someone whose phone number you know and have connected to the same WiFi.” Apple patched the vulnerabilities in iOS 10.1. As Apple and Google continue to push the front on technology, organizations must take other measures to keep their employees, customers, and intellectual property secure. Learn more about the latest security enhancements in the newly released Android 8.0 Oreo and soon-to-be released iOS 11 at our webinar on Thursday, September 14 – SAVE YOUR SEAT.
New Security Measures in iOS 11 and Their Forensic Implications
“Let us have a look at the changes and any forensic implications they have.”
A journey into Radare 2 – Part 2: Exploitation
“Welcome back to the second part of our journey into the guts of radare2! In this part we’ll cover more of the features of radare2, this time with the focus on binary exploitation.”
“Hackers can take control of the world’s most popular voice assistants by whispering to them in frequencies humans can’t hear.”
By issuing audio commands at frequencies above 20 kHz which are inaudible to humans, researchers successfully launched their “DolphinAttack” to take control of an iPhone 4s and Amazon Echo at a distance of almost 2 meters. Read more in the full paper “DolphinAttack Inaudible Voice Commands [PDF].”
Case Study of Mobile Billing Fraud in the Wild
(Sven Noblis at MRMCD 2017)
“13% of all mobile phone users were victims of WAP billing fraud in Germany. Until now, no research analyzed how this kind of attack works.”
Samsung to Launch Mobile Security Rewards Program, Welcoming Security Research Community
(Samsung Global Newsroom)
“Samsung Electronics today announced the launch of its inaugural Mobile Security Rewards Program, a new vulnerability rewards program which invites members of the security community to assess the integrity of Samsung’s mobile devices and associated software to identify potential vulnerabilities in those products.”
Android 8.0 Oreo, thoroughly reviewed
“We take a 20,000 word deep-dive on Android’s ‘foundational’ upgrades.”
If you want to receive #MobSec5 updates each Friday in your inbox, subscribe now via the NowSecure Subscription Center.