A new Android spyware named AwSpy targets South Korean users by masquerading as a recording app. It uses Amazon AWS as its C&C to exfiltrate contacts, SMS, photos and videos after requesting extensive permissions. #AwSpy #AmazonAWS
Tag: SPYWARE
Summary: A report by Zscaler reveals that over 200 malicious applications were distributed on Google Play, leading to nearly eight million downloads, with various malware families targeting users. Despite Google’s security measures, threat actors continue to find ways to bypass protections, resultin…
An exposed server was found hosting DDoS tooling (ddos.py and installation scripts referencing ZxCDDoS), SpyNote-related APKs with hardcoded C2s, multiple cryptocurrency phishing pages, and ransom-note web pages. The artefacts include observable IOCs such as 1…
Summary: Google Pixel phones, particularly the Pixel 9, have enhanced security features to protect against vulnerabilities in the cellular baseband, which manages network connectivity and can be a target for remote attacks. The implementation of various security measures aims to mitigate risks assoc…
Summary: Scammers are creating fake activation pages for popular streaming services, using SEO techniques to appear in Google search results, leading victims to malicious sites that display alarming fake alerts. These scams aim to panic users into contacting the scammers, who impersonate Microsoft t…
Vilsa Stealer is a Python-based information stealer discovered on GitHub that targets browser credentials, cookies, and 40+ crypto wallets while using encryption and anti-analysis checks to evade detection. Stolen data is archived and uploaded to a remote dash…
Want to learn more about hacking? Checkout our courses on https://www.hextree.io (ad)
I have spent many hours looking at the webp vulnerability used in the 0day attack against iPhones. In the past videos we have seen why fuzzers have a hard time finding the issue, so I wanted to understand how this was discovered. And I think I have a good theory!
Part 1: Huffman Tables https://youtu.be/lAyhKaclsPM
Part 2: Fuzzing libwebp https://youtu.be/PJLWlmp8CDM
Sources:
https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/
https://googleprojectzero.blogspot.com/2019/08/the-fully-remote-attack-surface-of.html
https://googleprojectzero.blogspot.com/2020/01/remote-iphone-exploitation-part-1.html
https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html
https://github.com/seemoo-lab/frida-scripts/blob/main/scripts/libdispatch.js
https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html
https://citizenlab.ca/2023/04/nso-groups-pegasus-spyware-returns-in-2022/
https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html
https://github.com/libjxl/libjxl/blob/4b9dbde293f7f282b6952a02340300abfca2b184/lib/jxl/huffman_table.cc#L51
https://github.com/webmproject/libwebp/blob/7861947813b7ea02198f5d0b46afa5d987b797ae/src/dec/vp8l_dec.c#L86C3-L86C76
https://github.com/Tencent/mars/blob/9ab46e19ed3d4fcafe9d0de4b36547321f5ead83/mars/comm/windows/zlib/inftrees.h#L41
https://github.com/google/brunsli/blob/master/c/enc/jpeg_huffman_decode.h#L20
00:00 – Intro
01:18 – The iPhone Remote Attack Surface
02:49 – Targeting iMessage
04:04 – Dangerous Parsing / BlastDoor
06:53 – Image I/O and libwebp
08:11 – A Pattern of Image Vulnerabilities
09:28 – Huffman Tables are Everywhere!
10:50 – My Theory: known issue with enough.c
13:50 – Outro
=[ ❤️ Support ]=
→ per Video: https://www.patreon.com/join/liveoverflow
→ per Month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
2nd Channel: https://www.youtube.com/LiveUnderflow
=[ 🐕 Social ]=
→ Twitter: https://twitter.com/LiveOverflow/
→ Streaming: https://twitch.tv/LiveOverflow/
→ TikTok: https://www.tiktok.com/@liveoverflow_
→ Instagram: https://instagram.com/LiveOverflow/
→ Blog: https://liveoverflow.com/
→ Subreddit: https://www.reddit.com/r/LiveOverflow/
→ Facebook: https://www.facebook.com/LiveOverflow/
Summary: Threat actors are exploiting public interest in the scandal surrounding Sean “Diddy” Combs to distribute spyware disguised as files that claim to reveal deleted social media posts. Researchers have identified a variant of the PySilon RAT, named “PdiddySploit,” embedded in these files, posin…
Want to learn more about hacking? Checkout our courses on https://www.hextree.io (ad)
I have spent many hours looking at the webp vulnerability used in the 0day attack against iPhones. In the past videos we have seen why fuzzers have a hard time finding the issue, so I wanted to understand how this was discovered. And I think I have a good theory!
Part 1: Huffman Tables https://youtu.be/lAyhKaclsPM
Part 2: Fuzzing libwebp https://youtu.be/PJLWlmp8CDM
Sources:
https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/
https://googleprojectzero.blogspot.com/2019/08/the-fully-remote-attack-surface-of.html
https://googleprojectzero.blogspot.com/2020/01/remote-iphone-exploitation-part-1.html
https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html
https://github.com/seemoo-lab/frida-scripts/blob/main/scripts/libdispatch.js
https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html
https://citizenlab.ca/2023/04/nso-groups-pegasus-spyware-returns-in-2022/
https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html
https://github.com/libjxl/libjxl/blob/4b9dbde293f7f282b6952a02340300abfca2b184/lib/jxl/huffman_table.cc#L51
https://github.com/webmproject/libwebp/blob/7861947813b7ea02198f5d0b46afa5d987b797ae/src/dec/vp8l_dec.c#L86C3-L86C76
https://github.com/Tencent/mars/blob/9ab46e19ed3d4fcafe9d0de4b36547321f5ead83/mars/comm/windows/zlib/inftrees.h#L41
https://github.com/google/brunsli/blob/master/c/enc/jpeg_huffman_decode.h#L20
00:00 – Intro
01:18 – The iPhone Remote Attack Surface
02:49 – Targeting iMessage
04:04 – Dangerous Parsing / BlastDoor
06:53 – Image I/O and libwebp
08:11 – A Pattern of Image Vulnerabilities
09:28 – Huffman Tables are Everywhere!
10:50 – My Theory: known issue with enough.c
13:50 – Outro
=[ ❤️ Support ]=
→ per Video: https://www.patreon.com/join/liveoverflow
→ per Month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
2nd Channel: https://www.youtube.com/LiveUnderflow
=[ 🐕 Social ]=
→ Twitter: https://twitter.com/LiveOverflow/
→ Streaming: https://twitch.tv/LiveOverflow/
→ TikTok: https://www.tiktok.com/@liveoverflow_
→ Instagram: https://instagram.com/LiveOverflow/
→ Blog: https://liveoverflow.com/
→ Subreddit: https://www.reddit.com/r/LiveOverflow/
→ Facebook: https://www.facebook.com/LiveOverflow/
Summary: A long-running watering hole attack, dubbed SilentSelfie, has compromised 25 websites linked to the Kurdish minority, aiming to harvest sensitive information for over a year. The campaign utilizes various information-stealing frameworks, including malicious Android applications that exploit…
Summary: A recently patched vulnerability in OpenAI’s ChatGPT app for macOS, known as SpAIware, could have allowed attackers to implant persistent spyware in the app’s memory, facilitating continuous data exfiltration. This exploit leveraged the memory feature introduced by OpenAI, which retains inf…
A new Android spyware campaign targeting individuals in South Korea has been active since June 2024, using an Amazon AWS S3 bucket as its C2 server to exfiltrate data. The malware operates with a simple codebase, disguises itself as legitimate apps, and has re…
Black Basta operates as ransomware-as-a-service (RaaS) and uses double extortion, demanding payment for decryption and the non-release of stolen data. It has impacted 500+ organizations globally, with initial access commonly gained via phishing, Qakbot, Cobalt…
Summary: The U.S. Treasury Department has sanctioned five individuals and one entity linked to the Intellexa Consortium, which is known for its development and sale of the Predator spyware. These sanctions aim to enhance accountability and disrupt the operations of companies involved in the prolifer…
Summary: Apple has voluntarily dismissed its lawsuit against NSO Group, citing concerns over the potential exposure of critical threat intelligence information amid a changing landscape in the commercial spyware industry. The decision reflects Apple’s belief that ongoing legal battles could compromi…