Snowblind malware abuses Android security feature to bypass security (www.bleepingcomputer.com)
from BrikoX@lemmy.zip to cybersecurity@sh.itjust.works on 27 Jun 2024 00:54
https://lemmy.zip/post/18080296

A novel Android attack vector from a piece of malware tracked as Snowblind is abusing a security feature to bypass existing anti-tampering protections in apps that handle sensitive user data.

#cybersecurity

threaded - newest

jet@hackertalks.com on 27 Jun 2024 02:54 next collapse

Snowblind targets apps that handle sensitive data by injecting a native library which loads before the anti-tampering code, and installs a seccomp filter to intercepts system calls such as the ‘open() syscall,’ commonly used in file access.

When the APK of the target app is checked for tampering, Snowblind’s seccomp filter does not allow the call to proceed and instead triggers a SIGSYS signal indicating that the process sent a bad argument to the system call.

ryannathans@aussie.zone on 27 Jun 2024 05:25 collapse

Finally some decent malware