Research & Threat Intel
To improve the guest experience and keep pace with competition, hotels worldwide are deploying digital key technology that allows guests to skip the front desk and use their mobile apps to remotely check in and go directly into their rooms without needing key cards. However, hotel mobile apps have vulnerabilities that can be exploited, as researchers demonstrated at the Black Hat USA 2019 conference.
In early September, radare2 users and developers from around the globe gathered in Barcelona for r2con, an annual conference celebrating the r2 multi-platform, open-source, reverse engineering framework supported by NowSecure. Around 200 attendees enjoyed four days of hacking, teaching, discussing, coding, socializing and having fun.
We frequently hear the same myths about mobile application security testing ranging from the notion that mobile apps are safe because Apple and Google test them to the notion that testing mobile apps is the same as testing web apps. These beliefs put organizations at risk of using and publishing mobile apps that are inherently insecure.
Discover what the top three misperceptions are and how to counter them.
Let’s examine how Android apps programmed using Kotlin could render Security By Obscurity ineffective. Kotlin is a statically-typed, general purpose language which was designed to interoperate fully with Java and the Java Virtual Machine. Android initially supported Kotlin in 2017 and it recently emerged as the preferred language Google recommends for Android app development. Kotlin Android apps offer a great example of why static analysis of binaries is better than static analysis of source code.
Last year, 66 million U.S. residents shopped online on Black Friday, topped only by 81 million on Cyber Monday. As an onslaught of consumers gear up to use retail and deal finding mobile apps to take advantage of post-Thanksgiving sales, companies should realized that many of those apps have security flaws that could compromise customer data.
The new NFL season kicks off on Sept. 7, 2018 and the NHL and NBA seasons resume a few weeks later. As their favorite players take the field, ice and court, millions of fans will wield their mobile devices to check game scores and compete in fantasy sports leagues. But just like some of the […]
On the eve of the ATARC Federal Mobile Technology Summit on August 30, 2018, NowSecure analyzed 88 publicly available mobile apps from across multiple U.S. federal government agencies. Overall, we found that 25% of 88 mobile apps have high and/or critical CVSS-scored vulnerabilities and over 20% do not comply with National Information Assurance Partnership (NIAP) requirements. Read the blog to see more data.
A staggering 85% of the 45,000 mobile apps reviewed for this benchmark analysis violated at least 1 or more of the OWASP MASVS. This benchmark report identifies significant risks of data leakage in mobile apps with insecure data storage, insecure network communications and insecure coding practices that all organizations must address in their risk models and app security programs.
Android Dirty COW patch released On Monday, Google announced putting the Dirty COW vulnerability (CVE-2016-5195) out to pasture with the 2016-12-05 patch level in the December 2016 Android Security Update. That’s welcome news for owners of Google Nexus and Pixel devices. Of course even with the patch from Google, the long standing problem of Android […]
With the release of Frida 6.0, it is now possible to instrument iOS apps on non-jailbroken devices.