[FD] Crashing Android devices with large Assisted-GPS Data Files [CVE-2016-5348]

Original at: https://wwws.nightwatchcybersecurity.com/2016/10/04/advisory-cve-2016-5348-2/ Summary Android devices can be crashed remotely forcing a halt and then a soft reboot by a MITM attacker manipulating assisted GPS/GNSS data provided by Qualcomm. This issue affects the open source code in

[FD] Crashing Android devices with large Proxy Auto Config (PAC) Files [CVE-2016-6723]

[Original at: https://wwws.nightwatchcybersecurity.com/2016/11/07/crashing-android-devices-with-large-pac-files-cve-2016-6723/] Summary Android devices can be crashed forcing a halt and then a soft reboot by downloading a large proxy auto config (PAC) file when adjusting the Android networking s

[FD] Insecure Transmission of Qualcomm Assisted-GPS Data [CVE-2016-5341]

[Also posted online: https://wwws.nightwatchcybersecurity.com/2016/12/05/cve-2016-5341/] Summary Assisted GPS/GNSS data provided by Qualcomm for compatible receivers is often being served over HTTP without SSL. Additionally many of these files do not provide a digital signature to ensure that dat

[FD] ChromeOS / ChromeBooks Persist Certain Network Settings in Guest Mode

[Original post can be found here: https://wwws.nightwatchcybersecurity.com/2017/04/09/advisory-chromeos-chromebooks-persist-certain-network-settings-in-guest-mode/] SUMMARY Certain network settings in ChromeOS / ChromeBooks persists between reboots when set in guest mode. These issues have been r

[FD] Multiple Vulnerabilities in ASUS Routers [CVE-2017-5891 and CVE-2017-5892]

[Original post here: https://wwws.nightwatchcybersecurity.com/2017/05/09/multiple-vulnerabilities-in-asus-routers/] Summary Various models of ASUS RT routers have several CSRF vulnerabilities allowing malicious sites to login and change settings in the router; multiple JSONP vulnerabilities allow

[FD] WhatsApp (Android) Privacy Issues with Handling of Media Files [CVE-2017-8769]

[Original post here: https://wwws.nightwatchcybersecurity.com/2017/05/17/advisory-whatsapp-for-android-privacy-issues-with-handling-of-media-files-cve-2017-8769/] SUMMARY WhatsApp Messenger for Android does not delete sent and received files from the SD card on the device when chats are cleared,

[FD] Google I/O 2017 Android App Doesn't Use SSL for Some Content [CVE-2017-9045]

[Original posted here: https://wwws.nightwatchcybersecurity.com/2017/05/17/advisory-google-io-2017-android-app/] SUMMARY Google I/O 2017 Application for Android does not use SSL for retrieving some information to populate the app. This would allow an MITM attacker to inject their own content into

[FD] Google’s Android News and Weather App Doesn’t Always Use SSL [CVE-2017-9245]

[Blog post here: https://wwws.nightwatchcybersecurity.com/2017/07/18/advisory-googles-android-news-and-weather-app-doesnt-always-use-ssl-cve-2017-9245/] SUMMARY Google News and Weather Application for Android does not use SSL for some server calls, exposing authentication tokens (OAuth) to anyone

[FD] Boozt Fashion Android App Didn’t Use SSL for Login [CVE-2017-11706]

[Original post here: https://wwws.nightwatchcybersecurity.com/2017/07/27/boozt-fashion-android-app-didnt-use-ssl-for-login-cve-2017-11706/] SUMMARY Boozt Fashion App for Android did not use encryption (SSL) for information transmission during login, exposing usernames and passwords to anyone moni

[FD] Chrome for Android Didn’t Use FLAG_SECURE for Credit Card Prefill Settings [CVE-2017-5082]

[Original post: https://wwws.nightwatchcybersecurity.com/2017/07/27/chrome-for-android-didnt-use-flag_secure-for-credit-card-prefill-settings-cve-2017-5082/] SUMMARY Chrome for Android did not use the FLAG_SECURE flag in the credit card prefills settings, potentially exposing sensitive data to ot

[FD] Updated advisory for CVE-2017-8769 - WhatsApp Issues with Media Files

*** The vendor has addressed these issues and we updated our advisory accordingly *** [Original post here: https://wwws.nightwatchcybersecurity.com/2017/05/17/advisory-whatsapp-for-android-privacy-issues-with-handling-of-media-files-cve-2017-8769/] SUMMARY WhatsApp Messenger for Android does not

[FD] Zoho Site24x7 for Android Didn’t Properly Validate SSL

Original post here: https://wwws.nightwatchcybersecurity.com/2017/09/27/zoho-site24x7-mobile-network-poller-for-android-didnt-properly-validate-ssl-cve-2017-14582/ TITLE Zoho Site24x7 Mobile Network Poller for Android Didn’t Properly Validate SSL [CVE-2017-14582] SUMMARY Zoho Site24x7 Mobile Ne

[FD] PIA Android App Can Be Crashed via Large Download [CVE-2017-15882]

[Original post here: http://wwws.nightwatchcybersecurity.com/2017/10/25/advisory-pia-android-app-cve-2017-15882/] SUMMARY The Android application provided by Private Internet Access (PIA) VPN service can be crashed by downloading a large file containing a list of current VPN servers. This can be

[FD] Follow-up on CVE-2017-8769 - WhatsApp Issues with Media Files

[https://wwws.nightwatchcybersecurity.com/2017/05/17/advisory-whatsapp-for-android-privacy-issues-with-handling-of-media-files-cve-2017-8769/] We reported an issue earlier this year to WhatsApp / Facebook, where after deleting chats the media files would be retained on the device. The vendor fixed

[FD] ChromeOS Doesn’t Always Use SSL During Startup [CVE-2017-15397]

[Original at: https://wwws.nightwatchcybersecurity.com/2018/01/01/chromeos-doesnt-always-use-ssl-during-startup-cve-2017-15397/] SUMMARY ChromeOS did not use SSL in all network calls originating from the ChromeVox component during startup. This could potentially have allowed an MITM attacker to

[FD] RCE in DuoLingo’s TinyCards App for Android [CVE-2017-16905]

[Original post here: https://wwws.nightwatchcybersecurity.com/2018/01/04/rce-in-duolingos-tinycards-app-for-android-cve-2017-16905/] SUMMARY The TinyCards Android application provided by DuoLingo can be injected with malicious content by an MITM attacker. Because this application is a web-app fra

[FD] Auto-detection of Compressed Files in Apple’s macOS

[On the web here: https://wwws.nightwatchcybersecurity.com/2018/02/25/research-compressed-files-auto-detection-on-macos/] [NOTE: This was originally discovered as a result of a different set of bugs in Google’s Chrome browser, details of which will be posted soon. While the impact of this particul

[FD] Download Protection Bypass in Google’s Chrome (multiple)

[Blog post here: https://wwws.nightwatchcybersecurity.com/2018/02/26/multiple-instances-of-download-protection-bypass-in-googles-chrome/] SUMMARY We have found several instances of files bypassing the download protection offered by Google’s Chrome browser. All of these have been reported to the v

[FD] Content Injection in Samsung Display Solutions Application for Android [CVE-2018-6019]

[Original post here: https://wwws.nightwatchcybersecurity.com/2018/03/01/content-injection-in-samsung-display-solutions-application-for-android-cve-2018-6019/] TITLE Content Injection in Samsung Display Solutions Application for Android [CVE-2018-6019] SUMMARY Samsung Display Solutions App for

Re: [FD] Auto-detection of Compressed Files in Apple’s macOS

, Feb 25, 2018 at 9:45 PM, Nightwatch Cybersecurity Research wrote: > [On the web here: > https://wwws.nightwatchcybersecurity.com/2018/02/25/research-compressed-files-auto-detection-on-macos/] > > [NOTE: This was originally discovered as a result of a different set > of bugs in Google’s

[FD] Android OS Didn’t use FLAG_SECURE for Sensitive Settings [CVE-2017-13243]

[Blog post here: https://wwws.nightwatchcybersecurity.com/2018/05/24/android-os-didnt-use-flag_secure-for-sensitive-settings-cve-2017-13243/] SUMMARY Android OS did not use the FLAG_SECURE flag for sensitive settings, potentially exposing sensitive data to other applications on the same device wi

[FD] Crashing Facebook Messenger for Android with an MITM attack

[Original post here: https://wwws.nightwatchcybersecurity.com/2018/07/09/advisory-crashing-facebook-messenger-for-android-with-an-mitm-attack/] SUMMARY Facebook Messenger for Android can be crashed via the application’s status check. This can be exploited by an MITM attacker via intercepting that

[FD] Sensitive Data Exposure via WiFi Broadcasts in Android OS [CVE-2018-9489]

[Blog post here: https://wwws.nightwatchcybersecurity.com/2018/08/29/sensitive-data-exposure-via-wifi-broadcasts-in-android-os-cve-2018-9489/] TITLE Sensitive Data Exposure via WiFi Broadcasts in Android OS [CVE-2018-9489] SUMMARY System broadcasts by Android OS expose information about the use

[FD] Sensitive Data Exposure via Battery Information Broadcasts in Android OS [CVE-2018-15835]

[NOTE: This bug is part of a series of three related Android bugs with the same root cause: CVE-2018-9489, CVE-2018-9581 and CVE-2018-15835. A presentation covering all three bugs was given at BSides DE in the fall of 2018.] SUMMARY System broadcasts by the Android operating system expose detaile

[FD] Sensitive Data Exposure via RSSI Broadcasts in Android OS [CVE-2018-9581]

[Blog post here: https://wwws.nightwatchcybersecurity.com/2018/11/11/cve-2018-9581/] [NOTE: This bug is part of a series of three related Android bugs with the same root cause: CVE-2018-9489, CVE-2018-9581 and CVE-2018-15835. A presentation covering all three bugs was given at BSides DE in the fal

[FD] Chrome Browser for Android Reveals Sensitive Hardware Information

[NOTE: This is an expanded version of an earlier post from 2015 with updated information and fix from the vendor. Full blog post here: https://wwws.nightwatchcybersecurity.com/2018/12/25/chrome-browser-for-android-reveals-hardware-information/] SUMMARY Google’s Chrome browser, WebView and Chrome

[FD] Content Injection in Amazon's FireOS [CVE-2019-7399]

[Original blog post here: https://wwws.nightwatchcybersecurity.com/2019/02/07/content-injection-in-amazon-kindles-fireos-cve-2019-7399/] SUMMARY The FireOS operating system provided by Amazon for Fire tablet devices can be injected with malicious content by an MITM attacker. An attacker can also

[FD] RCE in CGI Servlet – Apache Tomcat on Windows – CVE-2019-0232

[Original post: https://wwws.nightwatchcybersecurity.com/2019/04/30/remote-code-execution-rce-in-cgi-servlet-apache-tomcat-on-windows-cve-2019-0232/] SUMMARY Apache Tomcat has a vulnerability in the CGI Servlet which can be exploited to achieve remote code execution (RCE). This is only exploitabl

[FD] Exploring the File System via Jenkins Credentials Plugin Vulnerability – CVE-2019-10320

[Original blog post here: https://wwws.nightwatchcybersecurity.com/2019/05/23/exploring-the-file-system-via-jenkins-credentials-plugin-vulnerability-cve-2019-10320/] SUMMARY The recently fixed vulnerability in the Jenkins Credentials plugin (v2.1.19) allowed users with certain permissions to conf

[FD] XSS in SSI printenv command – Apache Tomcat – CVE-2019-0221

[Original blog post here: https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/] SUMMARY Apache Tomcat had a vulnerability in its SSI implementation which could be used to achieve cross site scripting (XSS). This is only exploitable if SSI is

[FD] Insecure Defaults in Adobe’s Mobile SDKs

[Original post: https://wwws.nightwatchcybersecurity.com/2019/11/06/insecure-defaults-in-adobes-mobile-sdks/] SUMMARY Example/default configuration files provided by Adobe within their mobile SDKs include several insecure options. These have also been found in the wild in multiple mobile applicat

[FD] Two vulnerabilities in Oracle’s iPlanet Web Server (CVE-2020-9315 and CVE-2020-9314)

(Original blog post here: https://wwws.nightwatchcybersecurity.com/2020/05/10/two-vulnerabilities-in-oracles-iplanet-web-server-cve-2020-9315-and-cve-2020-9314/) SUMMARY Two vulnerabilities were discovered in the web administration console of Oracle’s iPlanet Web Server which allow for sensitive

[FD] Supply Chain Attacks via GitHub.com Releases

(Original blog post here: https://wwws.nightwatchcybersecurity.com/2021/04/25/supply-chain-attacks-via-github-com-releases/) SUMMARY Release functionality on GitHub.com allows modification of assets within a release by any project collaborator. This can occur after the release is published, and w

[FD] Finding secrets in mirrored Git repositories

(Full blog post here: https://wwws.nightwatchcybersecurity.com/2022/02/11/gitbleed/) SUMMARY Due to a discrepancy in Git behavior, the full contents of a source code repository are not visible when making copies via the “git clone” command. The entire contents only become visible when using the “