VULNERABILITY Posts on XDA
It’s now easy to bypass MediaTek’s SP Flash Tool authentication
Devices with MediaTek chipsets have a BROM (boot read-only memory), which typically loads the preloader executable and subsequently boots the Android system, but also houses an alternative boot mode known as Download mode. It is strictly intended for OEM servicing and can be used to unbrick a device, just like Qualcomm’s Emergency Download Mode (EDL). A MediaTek-made...
PSA: If you use ShareIt on Android, you should probably look for alternatives
If you're using the ShareIt app on your phone, you may want to uninstall it right away. Cybersecurity giant Trend Micro has discovered glaring security vulnerabilities in the file-sharing app that can be "abused to leak a user's sensitive data and execute arbitrary code with ShareIt permissions." In a report on the matter, Trend Micro has...
PSA: If your PC runs Linux, you should update Sudo now
Despite the fact that tens of thousands of contributors actively pore over the source code of the Linux kernel and various Unix utilities looking for security flaws, it's not unheard of for serious bugs to go unnoticed. Just a day ago, the folks over at Qualys revealed a new heap-based buffer overflow attack vector that...
Critical MediaTek rootkit affecting millions of Android devices has been out in the open for months
On the first Monday of every month, Google publishes the Android Security Bulletin, a page that discloses all the security vulnerabilities and their patches submitted by Google themselves or other third-parties. Today was no exception: Google just made public the Android Security Bulletin for March 2020. One of the vulnerabilities that are documented in the...
Google Camera and Samsung Camera apps exposed camera and video intents to third-party apps
When compared to iOS, Android provides applications a lot of ways to interact with each other, enabling developers to build some of the more common Android features we have come to expect and love. This is made possible thanks to Android's Intent system, which allows any app to send any intent it wants, and allows...
Google now pays more for disclosing vulnerabilities in Chrome, Chrome OS, and some Play Store apps
One of the hardest aspects of maintaining a cross-platform product is ensuring its security. Vulnerabilities can be exploited on various platforms in various scenarios, and it's almost impossible for literally any company's security department to fix all of them on their own. That's why companies often use vulnerability disclosure rewards programs, which basically means giving...
Huawei opens a Vulnerability Reward Program with a max payout of ~$143,000
Mobile security is important for a number of reasons, no less because most of our personal lives now reside on our smartphones. From photographs to social media, anybody with malicious access to your device could, in theory, cause a number of problems in your life. That's why it's important to make sure you have the...
Fortnite Installer could be abused to silently install apps on Galaxy phones
The launch of Fortnite Mobile on Android hasn't been too great, especially since many of the supported devices really struggle to play the game with acceptable frame rates. The game launched as a Samsung Galaxy exclusive for only 3 days. The Fortnite Installer was first available on Samsung Galaxy Apps before Epic Games allowed non-Samsung...
Google acquires GraphicsFuzz, a firm which specializes in testing GPU reliability
Google has acquired GraphicsFuzz to improve GPU reliability within the Android ecosystem. GraphicsFuzz is a firm that specializes in testing GPU reliability by creating graphics driver testing technologies that can be used to find bugs in graphics drivers. The firm then discloses these bugs to GPU vendors, OEMs, or any other involved parties and works...
Many Android email apps and PayPal are vulnerable to recipient spoofing
A couple of months ago, we covered a story about a Google Inbox spoofing design flaw found by Eli Grey. It would allow for people to send mailto links that would spoof the recipient of the email. This could be used for tricking people to send emails to a different address than the one shown. The...
OxygenOS 5.1.7 update for the OnePlus 6 fixes bootloader vulnerability
Following a slew of updates for the OnePlus 6 since its launch, OxygenOS 5.1.7 is the first to offer strictly bug fixes and security enhancements. The first big fix for this update pertains to the bootloader vulnerability uncovered by a security researcher last week. It has been patched with an updated bootloader, so users are...![[Update: Fix] Bootloader Protection Bypass Discovered on OnePlus 6 (requires physical access)](https://www.xda-developers.com/files/2018/05/Silk_White_07-390x390_c.jpg)
[Update: Fix] Bootloader Protection Bypass Discovered on OnePlus 6 (requires physical access)
The OnePlus 6 was made official in the middle of last month. The device has only recently started to make its way into the hands of consumers and developers on our forums, and already we're hearing about the work that's being done. An official build of TWRP is already available and work is progressing nicely...- 1
- 2
