Tweets from September 2015

RT @Fuzion24: Google Play InAppPurchase hijacking research : http://t.co/cxX8AIKqci ... I used xposed and diff technique: https://t.co/fEGv8Bh5Hl

8:45pm September 30th 2015 via FalconPro3

RT @ikoz: SECURITY_PATCH comes from http://t.co/CCoMEDZrJ9.version.security_patch - interesting idea, I guess OS version not granular enough #Android

8:42pm September 30th 2015 via FalconPro3

RT @Mobile_Sec: "Mobile Application Reverse Engineering: Under the Hood" presentation by Drew Branch Billy McLaughlin at @DerbyCon http://t.co/PiHs9EHlWM

8:41pm September 30th 2015 via FalconPro3

RT @Mobile_Sec: "Exploiting Android In App Purchases" presentation by Alfredo Ramirez at @DerbyCon http://t.co/vkuB3iuhZg

8:41pm September 30th 2015 via FalconPro3

RT @Mobile_Sec: "The problems with JNI obfuscation in the Android Operating System" presentation by Rick Ramgattie at @DerbyCon http://t.co/lYZnrywKCc

8:41pm September 30th 2015 via FalconPro3

RT @AndroidPolice: Android Now Shows Your Device's "Android Security Patch Level" In Marshmallow http://t.co/olPsFARlo3

9:10pm September 29th 2015 via FalconPro3

RT @ChainfireXDA: Important notice regarding the future of SuperSU: https://t.co/Sh5j9G9hTb

5:04pm September 29th 2015 via FalconPro3

RT @jebdec: Latest JEB (2.0.12) coming up, see http://t.co/ufiRWpVdV5 + how to set it up for odex at http://t.co/n8SQ9zDBEu http://t.co/KjXoAekjkU

1:53pm September 29th 2015 via FalconPro3

RT @5aelo: Another #stagefright exploit, this one for the #HTC M7 which (so far) didn't get a patch for CVE-2015-3864 :/ http://t.co/7l6QbUevct

1:37pm September 29th 2015 via FalconPro3

RT @Amon_RA: Noticed that my N6 only showed 32Gb of storage. Did a "fastboot format userdata" to get the 64GB back. Don't blindly trust userdata img's ;)

1:36pm September 29th 2015 via FalconPro3

RT @xdadevelopers: Google Security Engineer explains the issues with Root & Android Pay in the XDA Forums! - http://t.co/ckh15d6k2g http://t.co/ScqWq4tjSw

1:34pm September 29th 2015 via FalconPro3

@0xroot @timstrazz @caleb_fenton @thomas_cannon awesome performance, was it a chiptune festival?

12:18pm September 26th 2015 via FalconPro3 in reply to 0xroot

@timstrazz @caleb_fenton @0xroot damn you Tim! listened it 5 or 6 times yesterday, now I can't get that sticky melody out of my head!

7:43am September 25th 2015 via Twitter Web Client in reply to timstrazz

RT @xdadevelopers: Root your S6 without tripping knox using the Engineering Bootloader - http://t.co/smG2wFygZ3

3:22am September 25th 2015 via FalconPro3

RT @Fuzion24: The Road to efficient Android fuzzing: http://t.co/7DlwxTtGvH

3:19am September 25th 2015 via FalconPro3

RT @timstrazz: An IDA Pro based Dex Dumper plugin https://t.co/5RyPpQq5wi

3:14am September 25th 2015 via FalconPro3

RT @timstrazz: Yet Another Dex Unpacker (Dumper) https://t.co/bem3AMFk4D

3:14am September 25th 2015 via FalconPro3

@Matmousegame @Mattun_Ken stream not started yet... at what time will start? thank you!

12:55pm September 24th 2015 via Twitter Web Client in reply to matmousegame

TIL about @opengapps buildscripts which allow for the automated creation of up-to-date Google Apps packages - http://t.co/bQLRWb3FNY

9:34pm September 21st 2015 via Twitter Web Client

RT @angealbertini: ArcadeHacker's desuicide projects are now on github! https://t.co/ODR9n7NmqC membership card may be required ;) http://t.co/XiYN6Ygml7

9:28pm September 21st 2015 via Twitter Web Client

RT @radareorg: The slides of the ESIL (emulating code in radare2) talk by @trufae http://t.co/5FsKeVjbBK

8:10pm September 21st 2015 via FalconPro3

RT @anestisb: For those interested into native Android fuzzing, I slowly port some private stuff to honggfuzz (https://t.co/CcEIUpHaq5). Check da fork too

5:49pm September 21st 2015 via FalconPro3

@jcase @jduck it was really nice, hopefully they'll repeat next year and you can come

5:06pm September 21st 2015 via FalconPro3 in reply to jcase

RT @Fuzion24: Some Samsung kernel bugs ... unpatched a year later: http://t.co/npGgpbG57U

3:28pm September 21st 2015 via FalconPro3

RT @ikoz: @pof that of course only holds true as long as safetynet does a decent job - which it does not if it only relies on selinux & su presence !

12:06pm September 21st 2015 via Twitter for Android

RT @ikoz: @pof as mentioned on another twitter thread, this doesn't work if devs implement safetynet properly. Demo app coming soon.

11:54am September 21st 2015 via Twitter for Android

No Device Check: xposed mod to defeat SafetyNet - http://t.co/dNp6vFC2sj SafetyNet Helper Sample: check CTS test - https://t.co/pIaSQmo4r4

11:48am September 21st 2015 via Twitter Web Client

RT @roman_soft: #lacon2k15 is over. Congrats to @layakk & @pof (best talks). Thx to all the speakers (who make Lacon possible) & the incredible @48bits

11:52pm September 19th 2015 via Twitter for Android

RT @rene_mobile: Most talks from our #AndroidSecuritySymposium are now online at https://t.co/mfjaisUVN6 with slides linked from https://t.co/bTrMSsM2rX

11:10am September 18th 2015 via FalconPro3

RT @ikoz: SafetyNet: Google's tamper detection for Android devices https://t.co/FTQWsAwxmJ

9:35am September 18th 2015 via FalconPro3

RT @Fuzion24: .@jduck Actually, this check appears to be part of SafetyNet which AndroidPay just uses. Moving su -> blah breaks safetynet LOL :D

9:35am September 18th 2015 via FalconPro3

RT @Fuzion24: Can we agree that root checks are dumb? #AndroidPay root@shamu:/system/xbin # mv su blah # circumvents this one http://t.co/QBHajxNDoG

7:41am September 18th 2015 via FalconPro3

RT @timstrazz: Interesting stuff for arm trustzone on a Raspberry Pi B+ https://t.co/GViqPM7jxQ

7:35am September 18th 2015 via FalconPro3

RT @_jsoo_: Mobile Security Challenge - http://t.co/lBeW97sluq Organised by Alibaba Security Team & pediy CC: @timstrazz @caleb_fenton @thuxnder

7:34am September 18th 2015 via FalconPro3

Finally! per app rotation settings without using accessibility service & keep boot password: https://t.co/aPlh6UADOW http://t.co/i9699IWrOP

3:09pm September 17th 2015 via Twitter Web Client

RT @timstrazz: AndFix: library for hot-fixing Android Apps https://t.co/xyirR5dSNY < This could be interesting

6:09am September 17th 2015 via FalconPro3

RT @insitusec: Let's start an open discussion on App CVEs, starting with Android App Vulnerabilities -- https://t.co/l5qqGAGRqz

5:56am September 17th 2015 via FalconPro3

RT @scottyab: Saw this on @reddit and thought this is how @pof likes his coffee http://t.co/cW0YYhXLdW

6:47pm September 16th 2015 via Twitter for Android

RT @_jsoo_: AAMO: Another Android Malware Obfuscator - https://t.co/ThfVdwxFgX CC: @timstrazz

3:39pm September 16th 2015 via FalconPro3

RT @heisecode: @jduck @Fuzion24 Hey guys you see it by review commits. This vulnerability is CVE-2015-3871 and it is found by me https://t.co/2UXptPgYiz

2:19pm September 16th 2015 via Twitter Web Client

from now on your Android lockscreen password can't be longer than 500 chars - https://t.co/cecrColwIL

9:43pm September 15th 2015 via FalconPro3

RT @indiecom: Android 5.x Lockscreen Bypass (CVE-2015-3860) http://t.co/K9gf1ghkrZ @UT_ISO

8:13pm September 15th 2015 via FalconPro3

RT @jduck: Just in case you thought ASLR mitigates libstagefright vulnerabilities -- https://t.co/WMhJ5i9T6f Maybe patching is the best bet after all.

8:11pm September 15th 2015 via FalconPro3

RT @AndroidTamer: Remotely Debugging Android Binaries in IDA Pro: https://t.co/zp4ZpXdIxz by @theqlabs

11:54am September 15th 2015 via FalconPro3

RT @oldfresher: Release PoC for CVE-2015-1528 https://t.co/80ngJwuKVq, Exploiting Heap Corruption due to Integer Overflow in Android libcutils

11:53am September 15th 2015 via FalconPro3

RT @jduck: I've been filing tickets against @fi01_IS01's version of PingPongRoot (CVE-2015-3636). Check em out https://t.co/0i1pl3CGh7

11:52am September 15th 2015 via FalconPro3

RT @insitusec: Announcing an on-device open source vulnerability test suite for Android https://t.co/e9mzZAYRoc

11:51am September 15th 2015 via FalconPro3

RT @Fuzion24: Android Vulnerability Test Suite is now opensource: https://t.co/7QdSCFQO6s ... An on-device app to test for recent device vulnerabilities

11:49am September 15th 2015 via FalconPro3

RT @riusksk: CVE-2015-3636 · PoC code for 32 bit Android OS https://t.co/jk5lgEsghr

11:41am September 15th 2015 via FalconPro3

RT @jduck: shell@shamu:/data/local/tmp $ ./x [*] CVE-2015-3636 ho!! commencing dangerous actions... [*] got root!! shell@shamu:/data/local/tmp # exit

11:21am September 15th 2015 via FalconPro3

RT @insitusec: been long time since Troopers 13 pres but here's my gadget patch to emulate a kb on Android https://t.co/zOJjpd95Ii http://t.co/sjpCmZA8dc

11:16am September 15th 2015 via FalconPro3

RT @legerov: releasing another old libstagefright bug with Vulndisco today, still 0day

7:43am September 15th 2015 via Twitter Web Client

RT @beist: Just another stagefright 0day by my coworker, chpie. this one is reasonably reliable, more than 50% against Nexus 5. http://t.co/V5qhKvOr6C

7:42am September 15th 2015 via Twitter Web Client

@Conceptes envia'm mail a pau arroba eslack punt org

3:37pm September 12th 2015 via FalconPro3 in reply to Conceptes

@ikoz @maldr0id @kapitanpetko @ahoog42 same here, very nice conf & hope to repeat next year again!

10:06am September 12th 2015 via Twitter for Android in reply to ikoz

@scottyab thanks Scott! hopefully we'll see each other in another Android event soon... long time without catching up with you

11:32am September 10th 2015 via Twitter for Android in reply to scottyab

@anantshri sure, do what you want just cite the source if you copy something from them :)

9:46am September 10th 2015 via Twitter for Android in reply to anantshri

@anantshri yeah, basic stuff but a nice walk through for people interested in tinkering with Android stuff :)

9:43am September 10th 2015 via FalconPro3 in reply to anantshri

@anantshri sorry, was just convenient for me to post it here from my device (on open wifi, still at the conference venue)

9:43am September 10th 2015 via FalconPro3 in reply to anantshri

@fcerullo its a Google Drive share containing a PDF, try with a desktop browser

9:14am September 10th 2015 via FalconPro3 in reply to fcerullo

RT @virqdroid: Android signature verification vulnerability and exploitation - http://t.co/RUiftGuP9G

9:12am September 10th 2015 via FalconPro3

Slides for my presentation on Android Security Symposium: Assessing Android Applications using command-line fu - https://t.co/DIeqSBUhYM

9:05am September 10th 2015 via Twitter Web Client

@ChrisJohnRiley yes! finishes tomorrow, are you around by any chance?

7:20am September 10th 2015 via Twitter for Android in reply to ChrisJohnRiley

ready for day 2 of Android Security Symposium in Vienna http://t.co/9kDEbosuGX

7:09am September 10th 2015 via FalconPro3

Nexus Security Bulletin (September 2015) - https://t.co/WQnnpUs0Ht

6:53am September 10th 2015 via FalconPro3

RT @AndroidPolice: Google Releases New Simplified Wallet App In The Play Store, Sets The Stage For Android Pay http://t.co/XH1wrrK3l0

6:51am September 10th 2015 via FalconPro3

RT @jduck: The previously FrieNDA'd repository is now public. Feel free to send pull requests! https://t.co/Letlzl0kEf

10:29pm September 9th 2015 via FalconPro3

@ikoz @kapitanpetko i brought it here on purpose to get it signed by Nikolay, knowing beforehand that he was going to be around ;)

10:27pm September 9th 2015 via Twitter for Android in reply to ikoz

RT @jduck: New AOSP changes posted, including primarily security fixes: http://t.co/QTH1WkQB0C

3:50pm September 9th 2015 via FalconPro3

RT @AndroidTamer: Spoofing and intercepting SIM commands through STK framework (Android 5.1 and below) (CVE-2015-3843): http://t.co/CKte5bgpSb

7:08am September 9th 2015 via FalconPro3

RT @virqdroid: Proxying Bluetooth devices for security analysis using btproxy: http://t.co/hPaeqxpr3P https://t.co/aCossLZwhN via @_conorpp #IoT #Bluetooth

7:04am September 9th 2015 via FalconPro3

RT @jcase: Wrote a quick xposed module for capturing dynamicallyloaded jars/dex files https://t.co/PSaqbIYowN

6:49am September 8th 2015 via FalconPro3

RT @Kev1nMark: @0xroot @pof Awesome stuff. I wrote a script a few weeks ago to track classes between versions of ProGuarded apps. https://t.co/SFR6xSKGn4

12:59am September 8th 2015 via Twitter for Android

RT @0xroot: JEB Plugin for decrypt DexGuard encrypted Strings. - https://t.co/mGpmzDeJrm

12:50am September 8th 2015 via FalconPro3

RT @AndroidPolice: Android M Begins Locking Down Floating Apps, Requires Users To Grant Special Permission To Draw On Other Apps http://t.co/kKycEJaUt5

10:01pm September 7th 2015 via FalconPro3

Next Thursday I'll be speaking at the Android Security Symposium in Vienna, w/ @ahoog42 @kapitanpetko @m0nk_dot - https://t.co/IQoX7PAta9

11:18am September 7th 2015 via Twitter Web Client

RT @matalaz: The Antivirus Hacker's Handbook written by @0xeb and I is out! http://t.co/NUHRZnvHHM eBook version here: http://t.co/N8nAo1AINf

12:38am September 7th 2015 via FalconPro3

RT @elazar: Interesting use of what I can only assume is GPS data from Android phones. https://t.co/gvew8s2KBE

12:35am September 7th 2015 via FalconPro3

RT @4Dgifts: This is serious Android exploitation by @oldfresher Exploit int overflow on Lollypop -> busybox. Tremendous work. https://t.co/q8BaseeIlR

4:34am September 5th 2015 via FalconPro3

RT @jduck: Looks like @metasploit is finally getting some @Android love! Several post modules just added to remove lock screens etc.

4:32am September 5th 2015 via FalconPro3

RT @opersys: "Android Platform Debugging and Development" at ESTF 2015, Bangalore: http://t.co/unko3DeFW5

4:24am September 5th 2015 via FalconPro3

RT @Fuzion24: CVE-2015-1534:: Android/Linux Kernel Binder race: https://t.co/P6BVF3HCGp

4:02am September 4th 2015 via FalconPro3

RT @timstrazz: KCon ( http://t.co/TXGBOyjavm ) slides available online some interesting #Android stuff https://t.co/idFSshLMV7

5:47am September 3rd 2015 via FalconPro3

RT @timstrazz: Awesome - more #Android unpacking tools released at HiTCON 2015 https://t.co/2H0d6FGUzk

4:35pm September 2nd 2015 via FalconPro3

RT @kapitanpetko: Yay, Nexus 6 with M preview refuses to boot if system partition modified. Although it should, according to docs... http://t.co/1ZLSuMXQhJ

7:23am September 2nd 2015 via FalconPro3

RT @collinrm: Mobile Security News Update September 2015 https://t.co/0kgllzTwZg #keyraider #headerinjection

7:14am September 2nd 2015 via FalconPro3

RT @AndroidPolice: Xposed Framework Is Now Official For Lollipop 5.0 And 5.1 On Most Devices http://t.co/xFzx4VOZSM

2:48am September 2nd 2015 via FalconPro3

@timstrazz @LookoutEng wow! good luck on your new endeavor then :)

2:47am September 2nd 2015 via FalconPro3 in reply to timstrazz