@Antoniojojojo no conozco droidVPN, pero a simple vista yo no dejaría pasar mi tráfico por el servidor vpn de un tercero
11:49pm July 31st 2012 via TweetDeck in reply to Antoniojojojo
RT @andremoulu: Android Exploitation : From 0 perm app to INSTALL_PACKAGES on Samsung Galaxy S3 http://t.co/MdHQrFO7 #android #exploitation
RT @saidelike: Great article: root your galaxy nexus AND keep it safe. Also, add a password to su binary and to your recovery image. http://t.co/Ymc67hTr
8:06am July 31st 2012 via web
RT @gtvhacker: Slides for our #Defcon presentation can be found at http://t.co/zq6pv3wm . Videos for the demos will be uploaded soon.
@xanda still on early beta but very complete and up to date, very promising :)
RT @freekey: ASCII gmaps -> http://t.co/ho0VBNlc
@timstrazz hahaha :) I'm about to go to sleep now... but saw your tweet and couldn't resist looking at the ruby sauce :P
RT @timstrazz: APKfuscator, the PoC tool I used for my #Blackhat talk "Dex Education: Practicing Safe Dex" is up on github; http://t.co/D4zHAzkW
RT @unaaldia: Malware logra eludir (de nuevo) el sistema Bouncer de Google Play http://t.co/udiyV62S
Downloading Santoku Linux Alpha Release: Linux distro for Mobile Forensics, Malware Analysis and App Security Testing - http://t.co/GQGXvtqq
RT @moxie: I've written a blog post summarizing the talk that @0x31337 and I gave at #defcon on breaking MS-CHAPv2: https://t.co/Ym8oPpq0
RT @Stericson: RootTools v2.2 has been released! https://t.co/8VgBOOAD
@trufae read http://t.co/vQDYZOv3 the server side is nodejs you'll like, sauce on github - http://t.co/YIz357xJ
@trufae yes, but that's what you need :P i've tested it on android and works amazingly well for mobile irc without draining the battery.
@trufae doesn't run on ios, but survives network loss/packet drop b/c it uses a server side client to translate irc protocol into json stram
@saidelike thanks :)
@trufae have a look at TapChat, mobile IRC done right - http://t.co/HA4JlYwm
Writeup by @cryptax on @thuxnder Android byte-code obfuscation challenge - http://t.co/aZCCc41W
RT @vicendominguez: Efi infected and filevault compromised in Macs.... WOW!: http://t.co/UqdNgO14
Just posted: Fortifying a Galaxy Nexus with stock-ish image and root access - http://t.co/gBEyWZKC #pofHQ
RT @mikko: Ubisoft’s Uplay DRM seems to contain a really bad remote vulnerability, pretty recklessly disclosed by Tavis Ormandy: http://t.co/HPmQUGZh
RT @subreption: For the record. Android exploit covering >80% of the market today: f572bff595b80061dde9028a12ef8df2f1e2db331a00f11bf2312f5529c7a725 - Soon.
@thomas_cannon seems doable, what about a NFC tag instead of a USB dongle to enter the encryption passwd at boot?
1:22pm July 29th 2012 via TweetDeck in reply to thomas_cannon
@dbph @thomas_cannon yes, you can also use a 3rd party lockscreen if you want separate passwords
@dbph @thomas_cannon not assuming it, but usually it's a pin/passw u have to enter in the lockscreen so people doesn't choose difficult ones
@jcespi2005 haha.. not really, but i find the project interesting and will have a look.
ios-ssl-kill-switch GitHub: MobileSubstrate extension to disable certificate validation on jailbroken iOS - http://t.co/3p4oXeix
btw @thomas_cannon if you change the encryption password using the command line, this passwd is different from lockscreen so it can b longer
.@dbph read @thomas_cannon slides: http://t.co/3wV6iYOL and http://t.co/9zzQmYkQ and put sthng that's not susceptible to dictionary attack
changing my #android encryption password after reading @thomas_cannon Cracking Encryption #defcon slides 'vdc cryptfs changepw <password>'
RT @thomas_cannon: My slides. Into the Droid – Gaining Access to Android User Data https://t.co/Ld64Irbw via @viaforensics sorry for registration requirement
RT @supercurio: This @xdadevelopers XDA TV video http://t.co/fKS6Hfss goes beyond and grown into a project: app & database, follow up: http://t.co/k5TM04kP
RT @trufae: My slides on #bitcoin at #ud4kamp12 #ud4kamp http://t.co/r32AMQlH enjoy. Feedback is welcome :)
RT @timstrazz: @thomas_cannon prepping for his talk, full crowd for "into the droid" on #android forensics http://t.co/bz1osaUZ
RT @collinrm slides for my talk "Probing Mobile Operator Networks" http://t.co/jRZ2HZI5 #blackhat
@Marccoga @interferencies teniu un mail... /cc @iolandatweets
@timstrazz thanks!
RT @timstrazz: Dex Education: Practicing Safe Dex http://t.co/s7ZGsZfS - my slides from #blackhat
Patiently waiting for @timstrazz 'Practicing Safe Dex' slides... #tictactictac
The Dark Art of iOS Application Hacking, #blackhat slides from @jzdziarski - http://t.co/MqUmP4Nj
RT @iMilnb: Android to chose one upstream for its libc (bionic), why not @NetBSD ? :) http://t.co/QIxP5P5V http://t.co/baq1DAJH #Android #libc #NetBSD
RT @carlosacastillo: [PDF] "96% of iOS apps and 84% of Android apps have the ability to access sensitive information from the device" http://t.co/sgfmPsW2
@PaulOBrien what's the benefit over Android's built in wifi tether? I don't get MiFis when you have a spare Android phone...
RT @fjserna: Slides and demo of my talk at #blackhat http://t.co/1uYyzwE6 Enjoy!
RT @trufae: Pwned nfc on harmattan and android. http://t.co/fttPEcb9
RT @jasonsoroko: @ochsff demonstrated getting a shell on Android by touching a phone to a NFC card.
@tripledes i was also thinking about it
@timstrazz @TeamAndIRC @0xroot we're all looking forward to it!
RT @pleed_: @dexlabsorg Just published a writeup about the dexter autotagging feature for automated code analysis. Read it here http://t.co/mKDwTxtl
Themida 2.2.1.0 released today, reversers rejoice - http://t.co/K5B2AHuQ
@braincode i posted the script on my blog some time ago :)
picture on last twit taken with my tablet, which is wifi tethered through GNex at the same time. Balancer script here: http://t.co/IyKdBJZp
load balancing across two usb tethered #android phones on the train with @simyo_es and @vodafone_es - http://t.co/Ix6eWezo
RT @carlosacastillo: Windows malware slips into Apple's iOS App Store http://t.co/ZVppnwjQ // Finally the first "real" malware (not PoC or PUP) in the App Store
I liked a @YouTube video http://t.co/g68WAybT Android DNS Poisoning: Randomness gone bad (CVE-2012-2808)
Weak randomness in Android’s DNS resolver (CVE-2012-2808) - [blog]: http://t.co/HWHDbKkE [pdf]: http://t.co/kZxOeG96
@saidelike @collinrm you can give ldpreloadhook a try, src is on github... android example here: http://t.co/TD7xmcQe
@MRYangQ no idea, sorry... try thebrd@mail.ru
@Marccoga @interferencies @iolandatweets @Morrofi carai! m'heu fet entrar ganes de vermutillo a la 1 de la matinada... #atraconbimensual
RT @EdiStrosar: seccomp (system call filtering feature introduced in kernel 3.5) tutorial: http://t.co/qHHfdNFf (via @vince2_)
RT @a4lg: Android における ASLR のランダム化によって生まれる乱雑な模様を視覚化。赤が app_process で黄が linker。どちらも ICS では一直線になるが、JB では乱雑な配置となっている。 http://t.co/UVBowaLp
11:14am July 23rd 2012 via web
@simyo_es es nacional, ahora os mando el correo
@simyo_es tengo SMSC correcto +34644109030, SMS se tarifica n el panel d consumo, pero destinatario no recibe. Android 4.1. q puede ser?
X-Ray vulnerability scanner for Android - http://t.co/5I0cDOyU looks promising :)
@MikeTracking jeje, com ho saps eh bandarra!
4:35pm July 22nd 2012 via TweetDeck in reply to MikeTracking
I liked a @YouTube video from @elscatarres http://t.co/Fm5Hvw1K Vola amb mi (Flying Free) - Els Catarres
RT @JuopunutBear: Tool for getting a HTC One V out of download mode released. http://t.co/2SbDWxGa ; http://t.co/MCkJzmkb
RT @thuxnder: my writeup about my dalvik bytecode obfuscation technique is now online: http://t.co/J98H0mr7 #android #re
RT @thuxnder: Finally, my android PoC crackme showing my obfuscation technique is online. http://t.co/LyikrYWr Have fun with it, i hope you like it.
RT @CrowdStrike: Android 4.0.1 Exploitation by our own @ochsff at Stephen Ridley & Stephen Lawler's Black Hat talk http://t.co/rncZn1eE
RT @jduck1337: Successfully obtained a connect-back shell on an Android 4.0.1 device after much work. More details to come next week at BlackHat =)
RT @AndroidPolice: Come on, Google. Why can't these be standardized, at least on Nexus devices? You can do it, we believe in you. http://t.co/ikw6j8dn
@MordodeMaru adb shell; su; pm uninstall com.lbe.security.lite
@MordodeMaru LBE no funciona en JB...
@thuxnder @ochsff AFAIK @radareorg backend for dalvik was written by @earada from scratch about 1yr ago, but has not been updated since then
8:17pm July 17th 2012 via Boid for Android in reply to thuxnder
RT @moxie: RedPhone, our Android application for making secure calls, is now available as open source: http://t.co/Af6hrP7u
@MordodeMaru glad to hear all went well :)
"Package Enabler" updated to auto enable packages on phone boot - http://t.co/RoZsDr8L
RT @timstrazz: Sent out a little PoC crackme that will be public after my Blackhat talk next week - wonder if people will like it :D
A must read: Exploit Mitigations in Android Jelly Bean 4.1 - http://t.co/ixUE7ddJ
@timstrazz pm enable, src is on my github
I've just released "Package Enabler" in the play store, it allows to enable disabled apps on rooted android phones - http://t.co/RoZsDr8L
RT @georgiaweidman: Info about the first public release of my Smartphone Pentest Framework: http://t.co/tgs7vxt3
@MordodeMaru mail a pau at http://t.co/pRoKNEqm
12:45am July 16th 2012 via TweetDeck in reply to MordodeMaru
Recommended on #googleplay - http://t.co/KsZK5tal #LOL #OMG #WTF
RT @clintongormley: "... allowing members of the Torvalds family to use colour management without causing further outrage" #opensuse 12.2 http://t.co/MyrPh0lY
RT @timbray: They’re redesigning HTTP: http://t.co/nWTJlrRA (Possibly very important).
RT @codebutler: New blog post: TapChat is mobile IRC done right http://t.co/rkL6qePv
NVFlash for Tegra3 (Transformer Prime) - http://t.co/2h0e2XVv
@dsixda congrats man, you pushed it hard! :)
@GabrielGonzalez i usually want to see tx power and rx sensitivity in wifi products, also number of radios and available frequencies on each
6:19pm July 13th 2012 via Boid for Android in reply to GabrielGonzalez
RT @Pwn2Own_Contest: Announcing details about Mobile Pwn2Own next week. Get your 0days ready!
Several weaknesses in implementation of security features in AirDroid - http://t.co/IRE4W9mu
RT @0xabad1dea: Some clever person has defeated iOS in-app purchases with deliberately MITM'ing yourself http://t.co/0fEUIbmu but protip: DON'T DO IT.
@saidelike good luck :)
RT @thuxnder: My slides from #spring7 about Android Bytecode Obfuscation are now available. At least some aspects: http://t.co/mnLTAnYr
@thuxnder this one is also handy as a quickref (includes more arch) [pdf] http://t.co/bR0KLvQs
@thuxnder true, but do u have any better dalvik opcode table? i was using http://t.co/7btduURO and http://t.co/hbEGd0NN now
Bytecode for the Dalvik VM - http://t.co/EjrsBhV3 (wish i knew this page existed before!)
@TeamAndIRC @timstrazz hahaha so true
RT @dsixda: Nice overview of the Android Camera http://t.co/VcspxI2O
@timstrazz yes... read something about sqli... ;)
@nwhusted lol :)
No android botnet :P viaForensics confirms Yahoo! Mail App Flaw - http://t.co/e4CB1D8v
That was it! *THANKS* RT @matrixrewriter @PaulOBrien @pof Right! Try: LD_LIBRARY_PATH=/system/lib pm
@TeamAndIRC @PaulOBrien $BOOTCLASSPATH is set correctly, will continue digging, thanks anyway :)
. @PaulOBrien same segfaults with root http://t.co/UslCAZve
I'm getting segfaults when using pm on Android, anyone seen this before? :/ http://t.co/nJ05KmHN cc @PaulOBrien
Thanks :) RT @PaulOBrien @pof you can just pm enable but they're disabled again on reboot.
@PaulOBrien can u give more details? any possibility of enabling them when running a stock rom?
@TeamAndIRC no idea, I was not registered
RT @lcheylus: android-nfc-paycardreader NFC card reader Android (reads some credit cards) src on Github, tool banned from Google Play http://t.co/VMTF0Pii
RT @PaulOBrien: Found where in Jelly Bean Google are PM disabling apps not for your region (Wallet, Ears etc.) - patched that right out! :-)
http://t.co/VK3OJ56y Security Breach: db leak with 1M passwords - http://t.co/8oj9NWzv
@jduck1337 meh... nothing special :/
RT @Dees_Troy: Slowly but surely updating website links and forum posts and rolling TWRP 2.2 out today with on-screen keyboard! http://t.co/28KucvaT #TWRP
@boidapp swiping to delete a list in 'my lists' column without confirmation is a bad idea, I accidentally deleted one of my lists :(
RT @xanda: RT @mubix: GNOME Keyring Cracker - Github halfgenius/gkcrack http://t.co/9UTv2HtK
4 Android Crackmes (via @timstrazz) - http://t.co/CmeotJP8
RT @timstrazz: Mobile Security Meetup, DexTemplate and smali-mode! http://t.co/KEPpx6uN
RT @dsixda: Fixed up de-odexing issues. Android Kitchen 0.198 now out. http://t.co/NUCTGg5V #xda #android
RT @timstrazz: Added a ton more coloring to emacs smali mode - let your smali files be full of color! http://t.co/Yei3BBWV
RT @dguido: @dakami hey Re: Android, have you seen my latest research? http://t.co/kDZHcqWO
MeeGo Security Architecture: an overview of Mobile Simplified Security Framework (MSSF) - http://t.co/2yC8xeo9
RT @AndroidPolice: [Update: Q&A Added] Video: Steve Kondik's I/O Meetup Presentation On CyanogenMod Now Available On YouTube http://t.co/3cKg9YlJ
@MordodeMaru ok, si tengo tiempo igual hago un post explicando el proceso :)
NIST Draft: Guidelines for Managing and Securing Mobile Devices in the Enterprise - [PDF] http://t.co/j9lpe2JX
@rhcp011235 still, no excuse for not encrypting your data ;)
@rhcp011235 LOL!!! it could get lost or forgotten anywhere, and if the person who finds it is tech savy you're fucked anyways :P
@rhcp011235 there's still risk of loosing your data if your phone gets stolen, as the wipe from oem unlock is not "forensics safe"
root + stock recovery + encrypted data + BootUnlocker (OEM locked bootloader) for daily use, and TWRP for nandroid and flashing OTAs = #WIN
just noticed TWRP (teamwin recovery) has support to decrypt encrypted userdata partitions since ~1 month - http://t.co/6q7s50V5
RT @carlosacastillo: More malware found hosted in Google's official Android market http://t.co/a2lH9rdV // Downloads payload (premium SMS sender) from Dropbox
RT @0xroot: [Instagram Vulnerability] Friendship Vulnerability - http://t.co/h3HT3IMc
@oliverxxx yes, you need root for a manual install via recovery. Otherwise wait for the OTA to show up on your device automatically.
@xanda oh... not much dev community on this i guess :( I decided long ago to only buy AOSP supported devices.
@xanda what device u have now? i have xoom (wingray) and gnex (maguro), both with JellyBean :)
Official #OTA link for yakju IMM76I (4.0.4) -> JRO03C (4.1.1) from google servers: http://t.co/5Qm5Bfpq #jellybean #JRO03C #yakju
RT @teameos: RT @xdadevelopers Post: [ROM][JB] Team EOS 3 *JELLYBEAN* Nightlies - Wingray / MZ604 / WIFI ONLY http://t.co/rjhxcUSi
Unlock and relock Galaxy Nexus bootloader without fastboot and w/o wipe (needs root) app: http://t.co/nxAtoj9E source: http://t.co/RP6vAJt3
@rhcp011235 should be no problem at all
@rhcp011235 nope, i'm running CWM
Official #OTA link for tajku JRN84D (4.1) -> JRO03C (4.1.1) from google servers: http://t.co/veViGPWj #jellybean #JRO03C #tajku
@rhcp011235 @TeamAndIRC here's the JRN84D -> JRO03C for takju https://t.co/c1ED2RhA
@TeamAndIRC the only one i've seen yet is JRN84D -> JRO03C for takju. Still no 4.1.1 OTA for yakju AFAIK :(
@timstrazz only valid for native dynamic code, no dalvik (and doesn't work with static native binaries either)
ldpreloadhook working on Android, demo: http://t.co/TD7xmcQe source: http://t.co/mQRQiTaP
Definitely a must read: The 'broken patent system': how we got here and how to fix it | The Verge - http://t.co/ATLr8g49
@tripledes me alegro de saber que estás bien... cuidate y anda con cuidado!
RT @mikko: Yet another Android trojan. This one downloads a 'security app' which captures online banking authorization codes. http://t.co/XduHJLuz
...and the Android equivalent available in contagio too: Android FindAndCall spyware - http://t.co/MZziStW2
ios "malware" sample uploaded to contagio mobile: Apple IPhoneOS FindAndCall spyware - http://t.co/r26Jm6eu
Loving the smell of Jelly Bean in the morning... #AOSP
RT @github: GitHub Android App Released https://t.co/8FWZFKIT
RT @BenLaurie: http://t.co/eHmdAYg0 - "Cyberoam UTM does not allow export of private key" - https://t.co/itCAfLX6 - key exported. Using hacker tool "cat".
@esanfelix most people won't as it main use case is LAN only, but never underestimate the power of human stupidity ;-)
@esanfelix no, the password goes in cleartext
DroidMote: Remote control of your Linux desktop (keyboard+mouse) from your Android phone: http://t.co/Bj3aQ3KL
Android Security Overview documentation updated to include Android 4.1 security enhancements - http://t.co/yN9xTmfZ
@Marccoga Jeje ets un pillo :P
RT @justinschuh: Explaining the rabbit hole that Pinkie Pie's #Pwnium exploit sent me down: https://t.co/J7O2JgyK
@cryptax make sure the filesystem on the USB key supports files larger than 4GB
I've submitted CVE-2012-1675 as lamest vendor response nomination for the pwnie awards /cc @matalaz
RT @romainguy: Eh, I wonder if this will get as much press as the original story http://t.co/MvOe3UlK
Android Network Analysis Redux - http://t.co/OgFNRIPf and Network Analysis With ProxyDroid & BurpSuite - http://t.co/4XN7BLTB /cc @0xroot
UEFI Secure Boot and Ubuntu (implementation details planned for 12.10) - http://t.co/7THOQWoR
@dsixda @rhcp011235 if you get no datasheet from the manufacturer, you can always reverse eng. the existing driver :P
it's 2012 and looks like @simyo_es is still not hashing its user's passwords, got my password in cleartext on the password recovery email.
RT @pentestit: Recon 2012 slides are now available - http://t.co/XgnqT7cN
@timstrazz btw, nice new avatar :P
@timstrazz ok, we'll see when they publish more details :) been a few days out of twitter and i'm catching up with old stuff...
@timstrazz agree that the vuln is lame, but why the video has to be faked?
I liked a @YouTube video http://t.co/RlJ1EKgr Clickjacking Rootkits for Android
I liked a @YouTube video http://t.co/pQFdMWyV Google I/O 2012 - Security and Privacy in Android Apps
From google IO, Security and Privacy in Android Apps - pdf: http://t.co/c8wX9NeD video: http://t.co/7U7qbBQX
Androwarn: Yet another static code analyzer for malicious Android applications - (github) http://t.co/jelZ6FxJ
never 'tell htc' about your phone crashes, the log file sent might contain all your keystrokes - (video: http://t.co/qnwdhRaX )
in other news, jelly bean has been ported to motorola xoom - http://t.co/dkRNwWyZ (Alpha ROM: http://t.co/zN5hiqVF )
RT @kaspersky: 'Find and Call' #malware detected in the #Apple iOS App Store and Google Play Store. Read more of our analysis here: http://t.co/wk5x1M4w
@0xroot waiting to see your "recipe" for this :) i guess you used some mitm proxy
RT @0xroot: After some days hitting my head against the laptop finally I did it. Android apps traffic over SSL intercepted. http://t.co/kUamEu7P
Android library for using the Honeycomb+ animation API on all versions of the platform back to 1.0! - http://t.co/RkbvSlzP
I'm looking for people with an USB or RS232 EETI (eGalax) Touchscreen on Linux, who can test my open source driver - http://t.co/mIqxZi3k
RELRO support has been added to Android 4.1, all 3rd party native apps will pick up relro protections - http://t.co/Kct3SNuJ
pretty good article about "Tuning Linux IPV4 route cache" - http://t.co/xNUjlv6g
Handy link: online SMS PDU encoder/decoder - http://t.co/Asdu2BlT