officercia.mirror.xyz/scaEkpIpF7pd9Dhsj26F3HguaYnwhDg9TeAGIo76aRY

#security #web2

Ignore any emails from the X.com domain!

• https://vxtwitter.com/officer_cia/status/1685265037932249089

#security #web2

APT29 strikes again, please watch out! 👀

• twitter.com/officer_cia/status/1687890085532835840

#security #web2 #alert #OpSec

Are there any known live telegram 0days currently around? Likely image based. I was informed by several individuals that they had gotten a very suspicious message.

• twitter.com/officer_cia/status/1699500769894941078

#security #web2 #opsec

Frontend Security

• Try: https://drive.google.com/file/d/12-e1g8Ad7q0avIOge-NELNBaDlpmk0TV/view

• Also: https://blog.embarklabs.io/news/2020/01/30/dapp-frontend-security/index.html a bit old but still…

• From ToB: https://docs.google.com/document/u/0/d/1-_0Wlwch_vtkPM4F-SdEXLjQYaYT7KoPlU2rjt7tkLQ/mobilebasic

#web2 #offtopic

Clarification: x.com/balancer/status/1704552288201883809

So they targeted the root DNS registrar.

#security #web2

This is typically called a “loader” among hackers and very wide-spread in GooglePlay. They spread Trojans this way. Google about Anubis/Cerberus.

Proofs: www.bleepingcomputer.com/news/security/cybercriminals-charge-5k-to-add-android-malware-to-google-play/amp/

• www.tomsguide.com/news/hackers-are-sneaking-malware-on-to-the-google-play-store-how-to-stay-safe

I bet this costs 20k$ for AppStore or more for hackers to add their malicious app to AppStore.

But what they can do with it? Well, on IPhone - only if you type it in (into this exact malicious app).

But. One can create a “QR code scanner” app and it can be malicious itself and hack your Binance (on Android).

• unit42.paloaltonetworks.com/banking-trojan-techniques/

On Android they can do literally anything and inject every and each app. It can also create a fake “Binance” page on top of your app and collects all of your taps. Sort of a “web skimmer”. This is called an “inject”.

• www.cleafy.com/insights/how-banking-trojans-threat-your-security-systems

And that’s why btw banks and crypto apps change their design regularly. In order to prevent such attacks. Because hackers have to get the real design of the app page (hard to reverse engineer this).

This is a big market. There are separate people who sell and create these “inject pages” to Trojan operators or Trojan owners.

• officercia.mirror.xyz/scaEkpIpF7pd9Dhsj26F3HguaYnwhDg9TeAGIo76aRY

There are people who do “loaders” into google play/appstore/others and also sell them to operators.

• officercia.mirror.xyz/0uiAGM50rkQSvHbptcrVkCkyxsnewpAFIdu3oyga42Y

And Trojan itself is a MaaS…Malware as a Service. This is a dark web sharing economy for real… Looks like a literal anthill 😅

#security #offtopic #web2

This study dives into the gap between literature guidelines and real developer behavior.

What's recommended vs. what's done in practice!

• x.com/xyz_remedy/status/1864584248771932325?12

#web2 #security