Collaborate Disseminate
How long do Android devices continue to receive security updates after they’re purchased? The answer is: barely two years. Continue reading One billion Android smartphones racking up security flaws
As the number vulnerabilities hit a historic high, battle-worn security teams are upping their patching game. Continue reading How to Get a Handle on Patch Management
A few years back, it was essential to turn off automatic downloading of MMS messages on Android. There was a security risk involved in leaving automatic downloading enabled.
Has this issue been fixed with modern versions of… Continue reading Still necessary to disable automatic downloading of MMS messages in Android?
Google’s top Android engineer describes how the attack surface is shrinking on the mobile operating system. Continue reading How Google Shrunk The Android Attack Surface
So now I have tried to put fake vtable with address of the pivot gadget on the heap. It goes through it, but than seg faults on 0x00000000
(gdb) attach 316
A program is being debugged already. Kill it? (y or n) y
Attaching … Continue reading Stagefright – stack pivoting fails
Here I control r2 (vtable)
0xb6712c48 <+7120>: ldr r5, [r2, #28]
0xb6712c4a <+7122>: ldrd r2, r3, [r8]
0xb6712c4e <+7126>: blx r5
How I understand it:
I control the r2 register (vtable), i… Continue reading Stagefright – building ROP stack – pivoting
Following this blog post – https://googleprojectzero.blogspot.de/2015/09/stagefrightened.html and this exploit – https://www.exploit-db.com/exploits/38226/
Still cannot get exploit to work. Enabled debugs to see it better:
… Continue reading Stagefright exploit – vtable overwrite – how this should happen?
Following this blog post – https://googleprojectzero.blogspot.de/2015/09/stagefrightened.html and this exploit – https://www.exploit-db.com/exploits/38226/
Still cannot get exploit to work. Enabled debugs to see it better:
… Continue reading Stagefright exploit – vtable overwrite – how this should happen?
Google said half of Android devices are unpatched and that percentage of potentially harmful apps on phones installed from all sources rose in 2016. Continue reading Half of Android Devices Unpatched Last Year
I’ve been doing a lot of research on Stagefright lately and it has been confirmed that many phone models running Android Lollipop and below are susceptible to the exploit.
So since my S3 did indeed turn out to be vulnerable… Continue reading Stagefright on Samsung Galaxy S3 running JB 4.3