David Weinstein
“Photo by FLO:D on Unpslash https://unsplash.com/photos/yQYQJaiypZE“ Technology advancements are constantly reshaping the way we communicate and conduct business. As the CTO of NowSecure, a mobile application security testing SaaS provider, I want to discuss a topic I believe is of timely relevance: post-quantum security and in particular within the mobile application context. The cryptographic landscape is […]
In this dire time, the world is grasping for critical healthcare solutions to fight COVID-19. Incredible people have stepped up to leverage technology in meaningful ways to benefit humanity. The current stay-at-home orders afford app developers precious time to build innovative solutions that can help speed the return to normalcy. Thanks to our significant experience writing and testing the security of mobile applications, we’ve amassed a series of best practices that can guide the development of safe COVID-19 apps.
An attacker can exploit iOS WebViews to make automatic calls to an attacker-controlled phone number OR FaceTime address. Our research has found that FaceTime URL (facetime://) handlers are frequently overlooked in iOS applications. The oversight allows an attacker to potentially capture a video or snapshot of the affected user by directing them to a webpage from within a vulnerable WebView.
Issues associated with many apps’ CEVs.
We have developed a testing suite for detecting the vulnerabilities of Android devices.
In this post I explain step-by-step how I solved the OWASP Mobile Security Testing Guide (MSTG) Crackme Level 1 using Frida (and how I then automated it).
- « Previous
- 1
- 2
- 3
- Next »