WebView debugging can be enabled via “WebView.setWebContentsDebuggingEnabled(true)”. Leaving WebView debugging enabled in production Android apps is a bad idea. Anyone who gets hold of the unlocked phone can access the app’s data forever.
Background A security company reverse engineered Snapchat’s android client and found all the api endpoints ( source). Bigger issue: The published proof of concept of using “find friends” feature to find whether a phone number is registered on Snapchat or not, and if it is, then its associated username and location of the user. Their claim was that despite informing Snapchat about the hole, Snapchat did nothing about it. As expected, someone published data of 4.6M registered users ( source) using the proof of concept provided. Snapchat responded saying that soon users will be able to opt-out of find friends feature.
A lot of work is happening in academia and industry on tools to perform dynamic analysis, static analysis, and reverse engineering of android apps. An updated list of the tools can be seen at https://github.com/ashishb/android-security-awesome.
Just completed reading " The Tangled web: A guide to securing modern applications" by Michael Zalewski. The book is surprisingly small given the amount of information it covers about the interaction of web browsers, websites, and client-side web technologies. The book starts with a discussion of what a valid URL could look like (http://yahoo.com:80@google.com/microsoft.com - think which site is being connected to here) and then discusses several fundamental building blocks of the modern web (like cookies) as well as standard technologies (like Flash) in depth....
Came across a few interesting posts like this on my wall today.
If you are looking for how to avoid or recover: read this one instead. In the past few weeks, a lot of Facebook users have received the following (or similar) messages posted by their friends Hi Friends see Face-book images rotate 360* see here » http://SHADYCLOUDS.TK/ Really cool Facebook revolving images. MUST SEE http://rotatingimage2.tk/. Following are observations and analysis of the same.
The post is written in honor of Sh. Hari Prasad, the winner of EFF Pioneer Award 2010
This article illustrates some examples of how the Indian government deals with (Information) Technology. Some of these projects are unheard of while some generated unnecessary hype.
CERT-In is a low-profile (Indian) government organization. The Government of India established the Computer Emergency Response Team (“CERT-IN”) to ensure Internet security. Many institutions, including the Ministry of Home Affairs, courts, the intelligence services, the police, and the National Human Rights Commission, may call on it for specialist expertise. CERT-IN’s stated mission is “to enhance the security of India’s Communications and Information Infrastructure through proactive action and effective collaboration” [ Source] I had a chance to visit CERT-In last week. The experience was overall good, unlike the typical dirty government office with laid-back employees, I saw employees enthusiastic about their work (and a colorful office).
If you have visited a HTTPS site and got an error message which you do not understand, then this article is for you. Here I cover the common errors encountered while browsing HTTPS sites.