Your Android’s accelerometer could be used to eavesdrop on your calls

Credit to Author: Danny Bradbury| Date: Tue, 23 Jul 2019 10:13:08 +0000

Researchers have created an attack called Spearphone that uses the motion sensors in Android phones to listen to phone calls, interactions with your voice assistant, and more.<img src=”http://feeds.feedburner.com/~r/nakedsecurity/~4/XizfSFAizIQ” height=”1″ width=”1″ alt=””/>

Read more

Chrome 76 blocks websites from detecting incognito mode

Credit to Author: John E Dunn| Date: Mon, 22 Jul 2019 13:24:56 +0000

Ever bypassed a website paywall using a browser’s privacy mode? It was once a simple hack, however, it no longer works for most websites.<img src=”http://feeds.feedburner.com/~r/nakedsecurity/~4/7mBVTCcCHZk” height=”1″ width=”1″ alt=””/>

Read more

Message to IT: Trusting Apple and Google for mobile app security is career suicide

Credit to Author: Evan Schuman| Date: Mon, 01 Jul 2019 05:47:00 -0700

Ready for the mobile security news that IT doesn’t want to hear about but needs to? When security firm Positive Technologies started pen-testing various mobile apps, security holes were rampant.

We’ll plunge into the details momentarily, but here’s the upshot: “High-risk vulnerabilities were found in 38 percent of mobile applications for iOS and in 43 percent of Android applications” and “most cases are caused by weaknesses in security mechanisms — 74 percent and 57 percent for iOS and Android apps, respectively, and 42 percent for server-side components — because such vulnerabilities creep in during the design stage, fixing them requires significant changes to code.”

To read this article in full, please click here

Read more

Tracing the Supply Chain Attack on Android

Credit to Author: BrianKrebs| Date: Tue, 25 Jun 2019 15:24:29 +0000

Earlier this month, Google disclosed that a supply chain attack by one of its vendors resulted in malicious software being pre-installed on millions of new budget Android devices. Google didn’t exactly name those responsible, but said it believes the offending vendor uses the nicknames “Yehuo” or “Blazefire.” What follows is a deep dive into the identity of that Chinese vendor, which appears to have a long and storied history of pushing the envelope on mobile malware.

Read more