Tamer Platform

Android Testing environment focusing on application pentesting, malware analysis and Reverse engineering. Maintained by @anantshri

[Tamer Platform @TamerPlatform]

AndroidTamer 5 to be launched soon based on Debian 10 (buster) to be launched today. Tamer5 is codenamed Aarush more here https://t.co/fWibyFDM1V. That also means AndroidTamer 4 is End Of Life from today. Will not be able to handle support request for it : https://t.co/PWgq7Bc8XW

[Mobile Hacker @androidmalware2]

Rules for Android Application Security

A collection of Semgrep rules derived from the #OWASP #MASTG for Android apps

Use the rules to scan them against decompiled APK files to find vulnerabilities #BugBounty #Pentesting
https://t.co/5SXIpxYYcF

[Axelle Ap. @cryptax @mastodon.social @cryptax]

This #r2pipe script can help: https://t.co/MAvgjzHBQo
#radare2 #dart

[Aditya K Sood @AdityaKSood]

#FIRSTCON23 Great time to present at the conference. We demonstrated Time-based SQL injection to exploit Nexus Android C&C panels. Great work by @0xrb on this research. #cybercrime #ThreatIntel #cyberattack #botnet

[Mobile Security @mobilesecurity_]

Vulnerabilities identified in Amazon Fire TV Stick, Insignia FireOS TV Series 📺
#MobileSecurity #AndroidSecurity by @BitdefenderLabs
https://t.co/s0H7R79KjY

[Tamer Platform @TamerPlatform]

Our official website https://t.co/kHOXrX5Jy7 will be down for upgrades and we will be back soon.

[BEDNAR~1 (Now on @[email protected]) @BednarTildeOne]

Published writeup and exploit for CVE-2022-20452, privilege escalation on Android 13 via Parcel use-after-recycle()

https://t.co/ZQe1kHU3jI

[Dinesh Shetty @Din3zh]

AERoot is a command line tool that allows you to give the root privileges to any process running on the Android emulator : https://t.co/e2HDLpM5gv by @quarkslab #MobileSecurity #AndroidSecurity #redteam

[Frida @fridadotre]

Frida 16.0.7 is out! 🎉
https://t.co/FRix5oRtE7

[NULLCON @nullcon]

Tech Talk🔼Upload

📴Tamir @tamir_zb revealed how the Android kernel (CVE-2021-1961) vulnerability was discovered & how he managed to overcome all existing security mitigations thus creating a 100% reliable exploit

🍿Enjoy the talk▶️https://t.co/vDJrabWE3w

#NullconGoa2022

[Tamer Platform @TamerPlatform]

A good reason to keep your phones updated.

[David Schütz @xdavidhu]

I found a vulnerability that allowed me to unlock any @Google Pixel phone without knowing the passcode. This may be my most impactful bug so far.

Google fixed the issue in the November 5, 2022 security patch. Update your devices!

https://t.co/LUwSvEMF3w

[Mishaal Rahman @MishaalRahman]

In addition, starting today, all updates to existing apps that use the Google Play Billing Library must use Billing Library version 4 or newer.

Details: https://t.co/Arn1wbBELh

(Thanks to @PatelPoojan92 for the reminder)

[FrenchYeti @FrenchYeti]

#DexcaliburPro on steroid💊 Just added device-oriented features to inspect / generate hooks to spoof data read from / write to device 😍 by any instrumented app on this device (1/n) @_bhamza @U039b @Farenain @trufae @EmericNasi @_reversense_ #hacking #android #frida #security

[Mishaal Rahman @MishaalRahman]

I've posted several threads on how app archiving will work, and @AssembleDebug's videos show it works exactly as I described!

By the way, this feature is also being worked on for Android TV/Google TV.

https://t.co/nSMmY6y5bg

[Tamer Platform @TamerPlatform]

This is a nice coverage of various frida hooks. Good job @0xbharath and @mast3root

[Bharath | భరత్ @0xbharath]

Here are the slides from our (@mast3root and I) talk on #Frida for Mobile app security testing at #THREATCON2022

This is a breadth first talk on Frida's capabilities on Android/iOS.

https://t.co/3PHX0HJk0V

PDF at https://t.co/zEKKEFN9Mz

[Anant Shrivastava @anantshri]

Interesting article especially the list of permissions is a fun read. Do check it out.

[GrapheneOS @GrapheneOS]

Games with latent memory corruption bugs such as Among Us, Diablo Immortal and others can now be used on GrapheneOS thanks to our new per-app exploit protection compatibility mode. Uses 39-bit address space and Scudo instead of 48-bit and hardened_malloc.

https://t.co/ORp32gD9sZ

[Mobile Security @mobilesecurity_]

A technical analysis of Pegasus for Android – Part 1
#MobileSecurity #AndroidSecurity
https://t.co/4IR6IzGpBx

[Mishaal Rahman @MishaalRahman]

TIL that it's possible to enable fastbootd on Samsung devices by hex patching the recovery image. It's apparently already there but hidden if engineering mode isn't enabled.

[Rahul Neel Mani @rneelmani]

#Android #malware developers are already adjusting their tactics to bypass a new 'Restricted setting' #security feature introduced by ⁦@Google⁩ in newly released #Android13. ⁦@dynamicCISO⁩ #mobilesecurity #100daysofcode #infosec https://t.co/tvZ7YCHkei

[Mishaal Rahman @MishaalRahman]

MagiskOnWSA is back, albeit in a new repo that requires building it locally instead of via GitHub Actions! Many speculate its (ab)use of GitHub Actions was why the original repo was disabled.

https://t.co/452SPOvcKF

https://t.co/2IwZHC9gGI

H/T @DavidBerdik