⚠️ PHP2Shell: Two Critical PHP Flaws Put Mobile Backends at Risk ⚠️ PHP2Shell: Two Critical PHP Flaws Put Mobile Backends at Risk See What to Check →

Research & Threat Intel

iOS 9 Reverse Engineering with JavaScript

By NowSecure Marketing / November 16, 2017 / Comments Off on iOS 9 Reverse Engineering with JavaScript

The new Frida 6.0 includes many exciting functionalities.

How to use Xcode to export an app for security testing

By NowSecure Marketing / November 15, 2017 / Comments Off on How to use Xcode to export an app for security testing

Security analysts typically rely on their development team to export an .ipa file for security testing iOS apps. This post provides step-by-step instructions for using Xcode to export an app for security testing purposes.

OnePlus Device Root Exploit: Backdoor in EngineerMode App for Diagnostics Mode

By NowSecure Marketing / November 14, 2017 / Comments Off on OnePlus Device Root Exploit: Backdoor in EngineerMode App for Diagnostics Mode

Learn more about the OnePlus device backdoor created by the EngineerMode App and how the NowSecure Threat Research Team helped verify this root exploit.

How to compile DVIA for iOS 10 and Xcode 8 for mobile app security testing

By Andrew Hoog / October 25, 2017 / Comments Off on How to compile DVIA for iOS 10 and Xcode 8 for mobile app security testing

If you’ve ever tried to compile DVIA for iOS 10 and Xcode 8, you probably ran into some challenges. This article teaches you step-by-step how to compile DVIA for mobile app security testing.

What is the Dirty COW vulnerability and how does it impact mobile security?

By NowSecure Marketing / October 21, 2017 / Comments Off on What is the Dirty COW vulnerability and how does it impact mobile security?

The Dirty COW vulnerability impacts many mobile devices. I analyzed it and its exploit and ended up writing a plug-in for Radare2.

Remote USSD Code Execution on Android Devices

By NowSecure Marketing / September 24, 2017 / Comments Off on Remote USSD Code Execution on Android Devices

Samsung Galaxy S3 can be triggered via an injected frame, QR code, Near Field Communications, or SMS text message

Ruminations on App CVEs

By Amy Schurr / September 16, 2017 / Comments Off on Ruminations on App CVEs

Issues associated with many apps’ CEVs.

Announcing Android Vulnerability Test Suite

By Amy Schurr / September 14, 2017 / Comments Off on Announcing Android Vulnerability Test Suite

We have developed a testing suite for detecting the vulnerabilities of Android devices.

Android buckles down and iOS opens up? Trends in platform security affecting developers

By NowSecure Marketing / August 24, 2017 / 0 Comments

Monday night, NowSecure Director of Research David Weinstein highlighted key trends in Android and iOS security in 2016 and participated in a panel discussion during Security by Design’s event “iOS and Android Security – Differences You Need to Know” in McLean, VA. Security by Design educates developers about secure development practices by connecting them with security experts at […]

New Mobile Risk: Decryption key published for iOS Secure Enclave Processor

By Andrew Hoog / August 18, 2017 / Comments Off on New Mobile Risk: Decryption key published for iOS Secure Enclave Processor

A researcher published the decryption key for the iOS Secure Enclave Processor exposing a critical new risk within the iOS operating system. We’ve verified this information and explained its impact.