Aggregator

The Washington Post is notifying nearly 10,000 employees and contractors that some of their personal and financial data has been exposed in the Oracle data theft attack. [...]

Our bulletin covering coordinated influence operation campaigns terminated on our platforms in Q3 2025.

SESSION
Session 2D: Android Security 1

Authors, Creators & Presenters: Mathias Oberhuber (Graz University of Technology), Martin Unterguggenberger (Graz University of Technology), Lukas Maar (Graz University of Technology), Andreas Kogler (Graz University of Technology), Stefan Mangard (Graz University of Technology)

PAPER
Power-Related Side-Channel Attacks using the Android Sensor Framework

Software-based power side-channel attacks are a significant security threat to modern computer systems, enabling adversaries to extract confidential information. Existing attacks typically exploit direct power signals from dedicated interfaces, as demonstrated in the PLATYPUS attack, or power-dependent timing variations, as in the case of the Hertzbleed attack. As access to direct power signals is meanwhile restricted on more and more platforms, an important question is whether other exploitable power-related signals exist beyond timing proxies. In this paper, we show that Android mobile devices expose numerous power-related signals that allow power side-channel attacks. We systematically analyze unprivileged sensors provided by the Android sensor framework on multiple devices and show that these sensors expose parasitic influences of the power consumption. Our results include new insights into Android sensor leakage, particularly a novel leakage primitive: the rotation dependent power leakage of the geomagnetic rotation vector sensor. We extensively evaluate the exposed sensors for different information leakage types. We compare them with the corresponding ground truth, achieving correlations greater than 0.9 for some of our tested sensors. In extreme cases, we observe not only statistical results but also, e.g., changes in a compass app's needle by approximately 30° due to CPU stress. Additionally, we evaluate the capabilities of our identified leakage primitives in two case studies: As a remote attacker via the Google Chrome web browser and as a local attacker running inside an installed app. In particular, we present an end-to-end pixel-stealing attack on different Android devices that effectively circumvents the browser's cross-origin isolation with a leakage rate of 5 - 10 s per pixel. Lastly, we demonstrate a proof-of-concept AES attack, leaking individual key bytes using our newly discovered leakage primitive.

ABOUT NDSS The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.

Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the organization’s’ YouTube channel.

Permalink

The post NDSS 2025 – Power-Related Side-Channel Attacks Using The Android Sensor Framework appeared first on Security Boulevard.

Europol-led Operation Endgame seizes 1,025 servers and arrests a key suspect in Greece, disrupting three major global malware and hacking tools, including Rhadamanthys, VenomRAT and Elysium botnet.

Компания ослабляет правила безопасности для опытных фанатов Android.

A vulnerability, which was classified as critical, was found in Red Hat Keycloak. This affects an unknown function of the component Debug Mode. Executing manipulation can lead to improper access controls. This vulnerability is tracked as CVE-2025-11538. The attack is only possible within the local network. No exploit exists.

A vulnerability, which was classified as critical, has been found in Sonarr 4.0.15.2940. The impacted element is an unknown function of the file C:\ProgramData\Sonarr\bin\Sonarr.Console.exe of the component Service. Performing manipulation results in incorrect default permissions. This vulnerability is identified as CVE-2025-13131. The attack is only possible with local access. There is not any exploit available. The vendor confirms this vulnerability but classifies it as a "low severity issue due to the default service user being used as it would either require someone to intentionally change the service to a highly privileged account or an attacker would need an admin level account". It is planned to fix this issue in the next major release v5.

A vulnerability classified as critical was found in Radarr 5.28.0.10274. The affected element is an unknown function of the file C:\ProgramData\Radarr\bin\Radarr.Console.exe of the component Service. Such manipulation leads to incorrect default permissions. This vulnerability is referenced as CVE-2025-13130. The attack can only be performed from a local environment. No exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #683894 / VDB-332362

Submit #683876 / VDB-332361

A newly documented malware campaign demonstrates how attackers are leveraging Windows LNK shortcuts to deliver the MastaStealer infostealer. The attack begins with spear-phishing emails containing ZIP archives with a single LNK file that executes a multi-stage infection process. When victims click the malicious shortcut, it launches Microsoft Edge while opening the AnyDesk website in the […]

The post MastaStealer Weaponizes Windows LNK Files, Executes PowerShell Command, and Evades Defender appeared first on Cyber Security News.

GlobalTenders[.]com 是一个成立于2002年的全球采购和招标平台，被誉为最大的招标和商业情报来源之一。图1 它致力于简化信息获取，帮助各种规模的企业发现新商机，通过从数千个网站和报纸收集并分类数据，每天发布超过50,000个招标通知。 主要功能与工具该网站的核心功能包括高级搜索工具，用户可根据关键词、行业、地区、通知类型、CPV（通用采购词汇）、截止日期和预计成本进行过滤，并支持保存收藏的搜索和通知。图9 黑鸟推荐：通过这个url可以直接筛选国家地区: 图2 globaltenders[.]com/index-country-tenders 点击右边的国家或地区按钮，就可以进到相关领域的投标项目 图3 再点一下下方全部按钮，就可以看到所有领域的投标项目 图4 点击感兴趣的领域，就可以看见对应内容，比方说点国防 图5 注册成员可访问个性化仪表板，查看推荐通知、收藏夹和邮件分享选项。 此外，电子邮件警报系统在工作日发送匹配关键词、目标地区和公司概况的新通知，确保用户及时获取相关信息。 首页还突出免费精选招标图6，并提供仪表板、分析工具和市场报告等功能。图7 全球覆盖与服务GlobalTenders.com 覆盖190多个国家，追踪超过500,000个机构，数据库包含90百万条以上记录，服务于投标者和采购方图8。 针对投标者，它提供过去趋势分析、比较研究、历史数据回溯和未来预测；针对采购方，则有基于关键词和CPV匹配的产品市场报告，帮助分析趋势和增长潜力。#开源情报网站分享计划

Europol’s Operation Endgame dismantles Rhadamanthys, Venom RAT, and Elysium botnet in a global crackdown on cybercriminal infrastructures. Europol and Eurojust have launched a new phase of Operation Endgame, carried out between November 10 and 13, 2025, dismantling major malware families including Rhadamanthys Stealer, Venom RAT, and the Elysium botnet as part of a global effort […]

A new npm worm dubbed “IndonesianFoods” has doubled the number of known malicious packages

A vulnerability classified as problematic has been found in otacke SNORDIAN's H5PxAPIkatchu Plugin up to 0.4.17 on WordPress. Impacted is the function insert_data of the component AJAX Endpoint. This manipulation causes cross site scripting. The identification of this vulnerability is CVE-2025-12904. It is possible to initiate the attack remotely. There is no exploit available.

Сообщение появилось после недавних ударов и усиления проверки возможных каналов утечки.