8kSec

NEW BLOG ALERT! The final part of the Android SELinux Internals series is now out on 8ksec.io/android-selinu…. This one covers the Treble policy split, a sesearch audit workflow, how kCFI/PAC/MTE/SCS stack up against exploit primitives, and what changed in Android 16.

A technical breakdown of three attack scenarios: chaining Android deep links with WebView misconfigurations, insufficient URL validation, bypassable host checks, and file:// URI exploitation to exfiltrate app data: 8ksec.io/android-deepli… 
Each one includes a working PoC against InsecureShop.
More Android app attack-surface deep dives on @8kSec

Our blog uses Frida to intercept plaintext messages from Signal and Telegram on iOS, two very different hooking challenges. Signal's Objective-C, so you hook TSIncomingMessage directly. Telegram's Swift, so you parse registers and heap structures: 8ksec.io/advanced-frida… 

E2E encryption doesn't protect messages once they're decrypted on the device.

Stay updated with @8kSec for more blogs like this

Learn how to read and analyze iOS kernel panic logs, extracting them, reading the panic string, calculating real addresses from the kernelcache slide, and symbolicating the backtrace: 8ksec.io/analyzing-kern… 

The example panic ties to a PUAF primitive, showing how one crash log can point you to an exploitation-related condition.

Follow @8kSec for more iOS kernel research

Here's our blog that details the mechanics of hacking a real Android game from the Play Store, extracting its compiled code, finding the function that handles money pickups, and hooking it at runtime to change the value on the fly: 8ksec.io/hacking-androi… 

No permanent modifications to the game needed, one script, and every coin pickup is worth more.

Keep learning with @8kSec. Follow us for more security resources!