The newest Mobile Security resources are on the Mobile Security page. For a reading order instead of a date order, see the Mobile Security learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2024-09-14 2024 | How Do You Configure VPN Split Tunneling on Ios and When Should You Use It? beginner | To configure VPN Split Tunneling on iOS, access settings, tap ‘General,’ then ‘VPN,’ choose the configuration, and toggle ‘Connect On… |
| 2023-12-28 2023 | Android Data Encryption in depth beginner 17 min read | Library analyzing Android's file-based encryption (FBE) at rest, detailing how attackers with software vulnerabilities might defeat it. It explores CE key derivation, focusing on TrustZone with the Gatekeeper Trusted Application and security chips using Weaver, and highlights that user credentials remain essential for unlocking data, even when chaining multiple vulnerabilities. |
| 2023-10-16 2023 | Comprehensive guide to Add Apple BLE spam module to Flipper zero via Xtreme Flipper Firmware intermediate | Comprehensive guide to Add Apple BLE spam module to Flipper zero via Xtreme Flipper Firmware https://ift.tt/tSy48qo |
| 2023-09-15 2023 | Five important iOS 17 security features coming to your iPhone this month beginner 4 min read | Reference detailing five key iOS 17 security features including Safari Private Browsing lock with Face ID, enhanced tracking prevention by automatically removing tracking parameters from URLs in Safari, Mail, and Messages, auto-deletion of verification codes from Messages and Mail after autofill, new Photos privacy permissions prompting users to limit app access to specific photos, and the "Check In" safety feature in Messages for automatic destination arrival alerts. |
| 2023-09-06 2023 | Hacker uses Flipper Zero to spam iPhone users with fake Bluetooth pop-ups news 2 min read | Tool utilizing Flipper Zero to spam iPhone users with persistent Bluetooth pairing pop-ups. This attack leverages Bluetooth Advertisements to mimic legitimate accessories like AirPods, overwhelming nearby Apple devices. The vulnerability persists even in Airplane Mode, with the only mitigation being disabling Bluetooth entirely in Settings. Demonstrations at Def Con 2023 highlighted the potential for rendering devices unusable through this method. |
| 2023-08-30 2023 | NosyMonkey: API hooking and code injection made easy! intermediate 12 min read API Sec | Library for simplified API hooking and code injection, enabling researchers to modify binary behavior without source code access. NosyMonkey automates the complex process of creating valid references for injected code within a target process, streamlining techniques like API micro-servicing for LSASS dumping or hiding processes from Task Manager. It avoids the need for manual shellcode generation and complex ASM patching, offering a more stable and less detectable approach to process manipulation. |
| 2021-12-31 2021 | A Memory Visualiser Tool for iOS Security Research intermediate | A Memory Visualiser Tool for iOS Security Research |
| 2021-09-05 2021 | Writing an iOS Kernel Exploit from Scratch advanced 43 min read RCE | Library for writing an iOS kernel exploit from scratch, focusing on chain #3 of a Google Project Zero exploit. It details setting up a test environment, reverse engineering IOKit drivers, analyzing a double-free vulnerability mitigated in iOS 11.4.1, and developing a full exploit using techniques including Siguza's sandbox escape. The entry serves as a beginner's reference for exploit development on iOS, with source code available. |
| 2021-06-28 2021 | How to encrypt your Mac iPhone and iPad backups beginner | This guide explains how to encrypt backups for Mac, iPhone, and iPad. Encrypting backups is crucial for protecting sensitive data, as unencrypted backups can be accessed by anyone with physical access to the backup file. The process typically involves using a password during the backup process. Specific steps vary slightly depending on whether you are using iCloud backups or local backups made with Finder (on newer Macs) or iTunes (on older Macs). Encrypting ensures that your personal information, such as passwords, health data, and home network details, remains secure. |
| 2021-06-11 2021 | Mobile Nuclei Templates beginner | Library of Nuclei templates designed for mobile security assessments. It includes specific templates for Android applications, focusing on `smali` checks. A dedicated `Keys` folder provides templates to identify API keys using regex patterns on decompiled Android apps, local code repositories, or unzipped IPA files. Users should install Nuclei from its GitHub repository to utilize these templates effectively for targeted mobile app analysis. |
| 2021-06-11 2021 | mobsfscan beginner 5 min read | Library for static analysis of Android and iOS source code, mobsfscan detects insecure patterns in Java, Kotlin, XML, Swift, and Objective C. It leverages MobSF static analysis rules, semgrep, and libsast, identifying vulnerabilities like CWE-295 Improper Certificate Validation and CWE-532 Insertion of Sensitive Information into Log File. Supported output formats include JSON, SARIF, SonarQube, and HTML, enabling integration into automated security assessment workflows. |