@_bagipro

Ranked as the #1 security researcher for Google Play Security Rewards Program. The founder of @OversecuredInc Android and iOS vulnerability scanners

oversecured.com/
Joined December 2015
  • Tweets159
  • Following188
  • Followers7.3K
16Media
On September 24, I’m hosting a free webinar with a special guest from Vimeo where we will discuss how AI is changing attacks on mobile apps, what new risks it creates, and what security teams should prepare for. Register here: my.demio.com/ref/uUIDncr8WxN…

How can AI attack your mobile apps?

my.demio.com
2
22
2,311
I'm opening a limited 5-week free pilot for Oversecured 2.0 You’ll be able to test the new platform on your own apps We’ll select a small group of companies for the first pilot: hub.oversecured.com/poc
1
20
2,157
I'm dreaming to talk with a strong, hands-on expert in web app security. Have interesting topics to discuss Google form: docs.google.com/forms/d/e/1F…

Meeting with web app security experts

Please fill out the form to let me know you better. I'll reach out to you soon

docs.google.com
2
16
2,582
On July 28, I'll host a live webinar introducing Oversecured 2.0 I'll show a new agentic approach to discover vulnerabilities, how we build vulnerability chains and create a map of attack vectors on your apps Link to register: my.demio.com/ref/OpYJi2G3QFs…

Introducing Oversecured 2.0: Live Demo + Pilot Invitation

my.demio.com
2
44
2,369
The largest vulnerability disclosure in the mobile history! 140 vulnerabiltiies in Samsung preinstalled apps github.com/oversecured/Samsu…

GitHub - oversecured/Samsung_Vulnerabilities: 176 vulnerabilities in Samsung preinstalled Android...

176 vulnerabilities in Samsung preinstalled Android apps - oversecured/Samsung_Vulnerabilities

github.com
11
150
691
39,304
I’m looking to talk to people who work with mobile app security inside companies. I want to better understand your real workflow, tools, pain points, and what still feels too manual. There’s a reward of your choice for the interview. Form: hub.oversecured.com/cusdev
1
11
1,794
[1/3] It's common to get a ParcelFileDescriptor pointing to a directory through an Android ContentProvider. But can you actually turn that into a directory listing?
1
2
2
28
3,283
[2/3] Examples: - FileProvider pointing to files/cache directories - A misconfigured ContentProvider that can be tricked into returning a ParcelFileDescriptor pointing to a directory
1
8
1,623
[3/3] With a directory listing you get the file names, and then you can read their contents through the same provider You can do it using native code!
1
9
1,458
We launched Android DAST. And the first problem we hit is that login flows block everything. So we used LLM to log in automatically. This is what debugging looks like
1
1
29
4,996
more replies
[2/3] The hard part: every app is different, so prompt engineering took a while
1
3
1,258
[3/3] We tried local models, but they didn't work for the general case. So we ended up going with the cloud models
6
1,115
An attack on Android content providers that researchers might overlook [1/4] Android has a mechanism to restrict access using the exported attribute or by requiring permissions
3
13
1
88
7,012
[2/4] But system apps ("android.uid.system" and maybe systemui) automatically bypass these restrictions and can access arbitrary components [3/4] It's trivial to force a system app to call ContentResolver.query() or openInputStream() for an arbitrary Uri
1
1
1
16
5,210
[4/4] If the implementation of ContentProvider.getType(), query(), openFile() does anything other than simply returning a ParcelFileDescriptor or data from a database (making directories, debug mode, dumping logs), an attacker can trigger it this way and gain privilege escalation
12
1,877
We’re hiring a Mobile App Security Expert! What you'll do: - Research Android/iOS internals and ship new SAST/DAST checks - Turn real-world findings into PoCs and write-ups - Be the technical voice with customers: explain findings, advise architecture, guide CI/CD setup
6
17
153
15,174
Interested? Fill out the form: docs.google.com/forms/d/e/1F…
10
2,604
New Android host validation bypass technique! [1/4] All parsed URIs in Android are android.net.Uri.StringUri objects. However, the scheme parser only looks for the ":" delimiter
5
73
1
300
29,436
more replies
[3/4] This will only work if the scheme isn't validated either. This attack can increase the impact in cases when, e.g., the victim's access token is appended to the request headers
1
9
3,672
[4/4] Limitations: 1. The lack of scheme validation 2. You also need to bypass the network security config: - Easy case: usesCleartextTraffic is set to "true" - Hard case: checking the app's network security config and trying to load your own host (or you control DNS responses)
11
3,379
Load more