Vulnerabilities in Hyundai and Genesis mobile apps allow full remote vehicle access and full account takeover - Mobile Security Briefing 2023.093

Sam Curry (Twitter | Homepage), a Web Application Security Researcher, and a small group of friends found a staggering number of serious vulnerabilities in the mobile and web apps of nearly 20 automotive companies. He provides a fairly detailed write up on his blog “Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and More” and here’s a Twitter thread about Hyundai and Genesis mobile app with starting with:

DoD IG report on mobile apps uncovers serious operational and cybersecurity risks - Mobile Security Briefing 2023.092

The Department of Defense’s Inspector General released a management advisory on 9 Feb 2023 titled “The DoD’s Use of Mobile Applications” (version with highlights). The advisory determined that: “DoD personnel are conducting official business on their DoD mobile devices using mobile applications in violation of Federal and DoD electronic messaging and records retention policies” “DoD personnel are downloading mobile applications to their DoD mobile devices that could pose operational and cybersecurity risks to DoD information and information systems.

NSA Mobile Device Best Practices - Mobile Security Briefing 2023.091

The National Security Agency (NSA) maintains a list of NSA Cybersecurity Advisories & Guidance and recently released a list of Best Practices For Securing Your Home Network. These are certainly worth taking a look at and for folks worried about downloading a PDF from the NSA, I’ve listed the primary recommendations at the bottom of this blog. While reviewing the document, though, I noticed a link to their Mobile Device Best Practices and wanted to pass that along as well.

Mobile Security and Privacy Weekly Digest - 2003.08

Your weekly digest of Mobile Security and Privacy News in under 8 minutes! Each digest will cover the past week of briefings so you can quickly catch up on all the important topics in mobile security and privacy. If you have any topics you’d like me to cover in the future, just drop me a comment in the YouTube video. Here’s links to the briefings covered in this weekly digest:

TikTok privacy insights via reverse engineering - Mobile Privacy Briefing 2023.084

On the more technical side, my friend Sebas creates a curated weekly summary of security (and other) topics in the Security Pills Newsletter. In Issue 27, he linked to an interesting technical write up of the great lengths TikTok has gone to obfuscate how their code works and in particular related to the sensitive personal data collected (shout our to vetias at nullpt.rs for the excellent re work and write up).

Scandinavian Airlines mobile app cyberattack - Mobile Security Briefing 2023.083

On 14 Feb 2023, Scandinavian Airlines warned users to stop using their mobile app as they were under an active cyberattack and user’s may receive incorrect data, including other customer’s personal information including: contact details previous and upcoming flights last four digits of the credit card number The incident was resolved several hours later but additional details are not available at this time. The last updated was posted in the Newsroom section of the SAS website on February 15, 2023 12:56.

Actively exploited WebKit flaw patched in iOS 16.3.1 - Mobile Security Briefing 2023.082

Apple released an emergency update to iOS, iPadOS, macOS and Safari on 13 Feb 2023 to patch a security flaw in WebKit, a web browser engine developed by Apple which powers many apps in the Apple ecosystem and beyond. The Security update page was updated on 20 Feb 2023 to include information on additional security flaws patched in the software update. If you haven’t updated your Apple devices yet, you should stop reading this article and upgrade immediately!

Mobile app privacy enforcement push from California Attorney General Bonta - Mobile Privacy Briefing 2023.081

In late January 2023, California Attorney General Rob Bonta announced a CCPA (California Consumer Privacy Act) enforcement focus on mobile apps. The enforcement focuses on “popular apps in the retail, travel, and food service industries” that don’t allow or comply with consumer opt-out requests. A recent CCPA settlement involving Sephora cost the company $1.2m in penalties and obviously compliance with CCPA plus regular reporting to the AG’s office. We’re also seeing federal enforcement of mobile app privacy issues from the FTC, most recently with a $1.

How to build an iOS app archive via command line

In my previous post, I detailed “How to export an Ad Hoc iOS ipa using Xcode” however there are advantages to exporting an iOS app archive using the command line. Top of mind reasons include: faster than using Xcode with a mouse can automate the build process (e.g. with GitHub Actions) Make sure you followed along in the previous post so all prerequisites are met or have an active iOS app that you’ve successfully built and exported at least once.

How to build React Native Android app with GitHub Actions

In this post, I’m going to automate the build process (see my previous post) for a React Native Android app with GitHub Actions. This obviously ties into the the DevOps tidal wave but in a way that’s very developer friendly. Developers spend significant time in GitHub and have a great developer experience (DX). Instead of popping out to external systems, you can build, test and deploy you app within GitHub and also leverage the extensive, open GitHub Marketplace to reuse workflows and integration into other systems.