Research & Threat Intel
On the eve of the ATARC Federal Mobile Technology Summit on August 30, 2018, NowSecure analyzed 88 publicly available mobile apps from across multiple U.S. federal government agencies. Overall, we found that 25% of 88 mobile apps have high and/or critical CVSS-scored vulnerabilities and over 20% do not comply with National Information Assurance Partnership (NIAP) requirements. Read the blog to see more data.
A staggering 85% of the 45,000 mobile apps reviewed for this benchmark analysis violated at least 1 or more of the OWASP MASVS. This benchmark report identifies significant risks of data leakage in mobile apps with insecure data storage, insecure network communications and insecure coding practices that all organizations must address in their risk models and app security programs.
Android Dirty COW patch released On Monday, Google announced putting the Dirty COW vulnerability (CVE-2016-5195) out to pasture with the 2016-12-05 patch level in the December 2016 Android Security Update. That’s welcome news for owners of Google Nexus and Pixel devices. Of course even with the patch from Google, the long standing problem of Android […]
With the release of Frida 6.0, it is now possible to instrument iOS apps on non-jailbroken devices.
An attacker can exploit iOS WebViews to make automatic calls to an attacker-controlled phone number OR FaceTime address. Our research has found that FaceTime URL (facetime://) handlers are frequently overlooked in iOS applications. The oversight allows an attacker to potentially capture a video or snapshot of the affected user by directing them to a webpage from within a vulnerable WebView.
A blog post providing an introduction on how to use Radare for Android malware analysis. After reading this post, you’ll understand how to use Radare2 to disassemble Android binaries, how to identify suspicious or malicious app behavior, and some of the benefits and limitations of using Radare2 for this use case.
The Android Vulnerability Test Suite lets Android users test their devices for security issues.
The new Frida 6.0 includes many exciting functionalities.
Security analysts typically rely on their development team to export an .ipa file for security testing iOS apps. This post provides step-by-step instructions for using Xcode to export an app for security testing purposes.
Learn more about the OnePlus device backdoor created by the EngineerMode App and how the NowSecure Threat Research Team helped verify this root exploit.