Posts tagged Android

6 min Android

12 Days of HaXmas: A year of Metasploit Android exploits

This post is the ninth in a series, 12 Days of HaXmas, where we take a look at some of more notable advancements and events in the Metasploit Framework over the course of 2014. It has been a busy year for Android exploitation here at Metasploit. As the makers of the greatest pentesting toolkit on the planet, vulnerabilities that affect over 1 billion active devices greatly interest us, not to mention the amazing independent researchers out in the world, such as Rafay Baloch [https://twitter.

2 min Android

Weekly Metasploit Wrapup: Exploiting Mobile Security Software

Exploiting Security Software: Android Edition It's hard not to sound gleeful when you've exploited security software. After all, this is software by and for Our People, people who are nominally In The Know about security. Security software is special, in that it's not merely supposed to be "secure," but is intended to enhance security for the user when installed and running. So, getting a working exploit together that targets this kind of software tends to feel more rewarding -- the security res

2 min Android

Metasploit Weekly Wrapup: Another Android Universal XSS

Click and Get Owned on Android... Again This week, we landed another Metasploit exploit for another Android WebView vulnerability [http://www.rapid7.com/db/modules/auxiliary/gather/android_object_tag_webview_uxss] ; this time, it's a problem that occurs when replacing the "data" attribute of a given HTML object with a JavaScript URL scheme. Like the last Android security disaster [/2014/09/15/major-android-bug-is-a-privacy-disaster-cve-2014-6041] we made a lot of noise about, this affects the st

3 min Android

Ahoy! It's the Metasploit Weekly Wrapup: More on Android UXSS and refreshing JSObfu

First things first -- today is International Talk Like a Pirate Day [http://www.talklikeapirate.com/howto.html], which is great for me, given my office decor [http://i.imgur.com/XGnzkMm.jpg]. Arrr! So grab a flagon of grog, and read on, ye landlubbers! Updates to the Android Universal XSS bug (CVE-2014-6041) This has been a pretty busy week for us here in Metasploit Nation. You probably heard about Rafay Baloch [https://twitter.com/rafaybaloch]'s kind of massive SOP-busting Android disclosure

1 min Android

Android browser privacy bug explained [VIDEO]: Whiteboard Wednesday

todb [https://community.rapid7.com/people/todb]'s post earlier this week about the flaw in Android's Open Source Platform browser [/2014/09/15/major-android-bug-is-a-privacy-disaster-cve-2014-6041] has been getting a lot of attention this week, and for good reason: By the numbers, Android 4.2 and earlier builds have the vulnerable browser in question, and about 75% of Androids in the world today are using pre-4.4 builds. While not everyone uses the AOSP browser on their phone—certainly Firefox,

3 min Android

Major Android Bug is a Privacy Disaster (CVE-2014-6041)

On the night of September 7, 2014, Joe Vennix of Rapid7's Metasploit Products team wrote, "I did not believe this at first, but after some testing it seems true: in AOSP browser before Android 4.4, you can load javascript into any arbitrary frame or window [...]" and provided a Metasploit module [https://github.com/rapid7/metasploit-framework/pull/3759] to exploit this condition. After some of the usual testing and confirmation of the vulnerability, this module is available in all versions of Me

5 min Apple

Weekly Metasploit Update: Apple, GDB, and Dogecoin

Apple TV Tricks This week, we have three new auxiliary modules that facilitate taking over Apple TV devices, all from community contributor 0a2940 [https://twitter.com/0a29], with help from Wei sinn3r [https://twitter.com/_sinn3r] Chen and Dave TheLightCosine [https://twitter.com/TheLightCosine] Maloney. Why Apple TV? Well, for starters, we already have modules for Google's Chromecast, a similar chunk of consumer hardware, and we didn't want Google to think we were picking on them. Secondly,

2 min Android

Weekly Metasploit Update: Zeroing in on Mobile

The Android Exploit Mixin This week, Rapid7's Joe Vennix [https://twitter.com/joevennix] refactored our tried and true methods for exploiting the addJavascriptInterface vulnerability [http://www.rapid7.com/db/modules/exploit/android/browser/webview_addjavascriptinterface] , which happens to be present on a ton of consumer Android devices and Google Play store-approved apps, which means a couple things for Android exploit developers. First, there's now a testable library for adding new and exciti

3 min Android

Weekly Metasploit Update: Meterpreter Madness

Meterpreter Updates This week, we saw another slew of updates to Metepreter to make your post-exploit experience all the more pleasant, and are pushing forward with some core release changes to hopefully make installing Metasploit a more sane, Ruby-like experience. Here's the rundown of what you'll see with this update, and what you can expect Real Soon Now. Android Meterpreter The long promised/threatened Android Metepreter is now shipping, thanks largely to the heroic efforts from mihi [https

2 min Flash

Weekly Metasploit Update: More Meterpreters!

Meterpreter for All The Platforms This week is pretty exciting for us, since it's not every day we give out commit rights [https://github.com/rapid7/metasploit-framework/wiki/Committer-Keys] to the Rapid7 Metasploit repo. I'm very happy to report that Tim Wright [https://github.com/timwr] has agreed to step up and help out with moving Meterpreter research and development forward, focusing mainly on the Java and Android implementations. Many Metasploit users are familiar with Meterpreter for Wi

5 min Exploits

Weekly Metasploit Update: Android WebView Exploit, Clipboard Monitor, and Mass Checks

Android WebView Exploit, 70% Devices Vulnerable This week, the biggest news I think we have is the release this week of Joe Vennix [https://twitter.com/joevennix] and Josh @jduck [https://twitter.com/jduck] Drake's hot new/old Android WebView exploit. I've been running it for the last day or so out on the Internet, with attractive posters around the Rapid7 offices (as seen here) in an attempt to pwn something good. I've popped a couple shells, I guess I didn't make my QR Code attractive enough

1 min Android

Federal Friday - 12.20.13 - Deck the Halls Edition

'Tis the season to be jolly! Happy Holidays everyone! While it's amazing that Christmas is next week, it's not amazing how much shopping I still need to do (shh, don't tell my wife). Being that the season of gift giving is here it make sense to highlight a major request on many a letter to Santa Claus. Mobile devices! The focus this year, as in recent years, has been on the latest smartphones and tablets.There have been a few article put out this week regarding some of the security capabilitie

4 min Android

National Cyber Security Awareness Month: Keeping Mobile Devices Safe

To mark National Cyber Security Awareness Month, we're trying to help you educate your users on security risks and how to protect themselves, and by extension your organization. Every week in October we'll provide a short primer email on a different topic relating to user risk. The idea is that you can copy and paste it into an email and send it around your organization to promote better security awareness among your users.  The first post was on phishing [/2013/10/02/national-cyber-security-awa

2 min Android

Federal Friday - 8/30/2013: DHS/FBI Highlight The Importance Of Keeping Android Devices Updated

A memo [http://publicintelligence.net/dhs-fbi-android-threats/] sent to Police, Fire and EMS personnel nationwide from the FBI and Department of Homeland Security earlier this summer, was recently made public.  According to the memo, the Android operating system is the primary target for mobile malware attacks.  At face value, this would not be surprising given that Android commands ~ 80% market share in the US, so should proportionally experience the largest number of malware attacks.  However,