Inquiring Minds: Exploratory road trips, malware, and cool tools and services

Bytecode - Covering the Android Vulnerabilities Master Key and Extra Field

This post will walk through our coverage for the Master Key and Extra Field vulnerabilities. Both vulnerabilities allow arbitrary files to be added to signed APKs without breaking the digital signature. ClamAV bytecode signatures allow for flexible coverage when a vulnerability o

Microsoft Update Tuesday August 2013: More font issues, some interesting DoSes

It's a pretty standard month for Update Tuesday this time around. There's a total of 8 bulletins, covering 23 CVE issues. This bulletin addresses the final 2 issues reported during CanSecWest's Pwn2Own. As usual, there's the requisite IE bulletin (MS13-059), whic

Android Extra Field Vulnerability Spotted in the Wild

It has been 20 days since the Extra Field vulnerability (also known as Chinese Master Keys) was first reported (translated link) by the Android Security Squad. It has now been spotted in the wild. The linked sample (MD5: C9F4C62521C04B8ADD796A1D5CEE08B0), which will be referred t

Androrat - Android Remote Access Tool

Androrat Androrat is an appropriately named remote access tool (or RAT) for Android. In case you're unfamiliar, RATs provide backdoor functionality to an operator, giving access to your system and private data. Androrat recently fell into the spotlight thanks to this Webroot

Microsoft Update Tuesday: July 2013: an issue of TrueType fonts

This month's Update Tuesday looks pretty interesting. As usual, there's quite a few CVEs covered and most of them are once again in IE: there's a total of 7 bulletins, covering 34 CVE issues. However, one CVE is shared between 3 bulletins. MS13-052 covers the .NET fr

Microsoft Update Tuesday, June 2013: mostly about Internet Explorer

Another month brings us another Update Tuesday. This month is pretty light with respect to the updates that Microsoft is releasing. They're releasing a total of 5 bulletins, covering 23 CVEs. First and foremost are the critical updates for Internet Explorer (MS13-047). They

Java Web Start or as it should be called "Sure go ahead and run what you like"

Late last month, Immunity published a blog post concerning a new way to escape the Java security warnings using a novel and simple method, by using the convenient Java Web Start framework. The Immunity team discovered a parameter called __applet_ssv_validated that sets whether yo

Microsoft Update Tuesday: Update for IE8 0-day and More

Today is Update Tuesday and Microsoft is releasing updates for 33 CVEs across 10 bulletins. We'll be discussing some of the highlights here. One of the most important updates (MS13-038) that is being released is for the recent 0-day in Internet Explorer, which was used in a