A teardown of an Anatsa (TeaBot) payload: parser traps, a SPECK-encrypted dex, and a class loader that isn't yours. I went looking for a Google Play dropper. Droppers are my favourite kind of Android
During a recent bug bounty engagement I found a path traversal in an Android app that lets any other app on the device write arbitrary files into its private storage. The attacker app needs no permiss
Remote Compose (androidx.compose.remote) is an experimental Jetpack framework that allows you to define UI on a backend and render it natively on Android. Unlike traditional Server-Driven UI (SDUI) th
I heard publishing an Android Launcher app on Play Store is not as straightforward as publishing any other app due to the level of permissions that it requires. That's not the only reason why I will m
Two years ago, I wrote an introduction article for how components communicate with each-other across the whole Android system. This article would assume that the reader has some knowledge about inter-
Hello everyone. It’s been quite a while. Today’s post will not be technical. I wanted to share mostly what I have learned during these eight years working as an Android Developer in a variety of domai
This post is inspired by an experience I had with one Bug Bounty program. Basically, the subject app under test had a completely broken cryptography layer, which I was able to replicate in a separate
Deep links are a big issue when it comes to Android security. The slightest mistake, like, for example, a typo, could lead to major issues like data leaks or theft. The Android documentation also ment
Dynamic analysis is a crucial part of my everyday work, whether it’s for a bug bounty program or a client security audit. In fact, it provides a broader perspective than static analysis. Static analys