Mobile Security Archives - 7ASecurity Blog https://7asecurity.com/blog/ Helping you secure apps and websites Wed, 26 Mar 2025 08:54:19 +0000 en-US hourly 1 https://7asecurity.com/blog/contents/uploads/2019/06/favicon.ico Mobile Security Archives - 7ASecurity Blog https://7asecurity.com/blog/ 32 32 Círculo Security Audit by 7ASecurity https://7asecurity.com/blog/2025/03/circulo-security-audit-by-7asecurity/ Tue, 18 Mar 2025 10:37:10 +0000 About Círculo Círculo is a safety app built on the Matrix protocol that enables users in authoritarian contexts to create a small “trusted circle” of six people with whom they can share location, safety, and wellness updates, as well as other messages in a secure environment. Audit Description OTF’s Security Lab partner 7ASecurity conducted penetration testing and a “whitebox” audit (a form …

The post Círculo Security Audit by 7ASecurity appeared first on 7ASecurity Blog.

]]> AmneziaVPN Security Audit by 7ASecurity https://7asecurity.com/blog/2024/12/amneziavpn-security-audit-by-7asecurity/ Sat, 14 Dec 2024 14:40:48 +0000 Our team of senior security experts recently completed another comprehensive security audit of AmneziaVPN. Over a 16-day period, we rigorously examined their Android, iOS, and Desktop clients, as well as their AmneziaWG and XRay services. Our goal was to identify any potential vulnerabilities and assess the overall security posture of their VPN solution. Key Findings: …

The post AmneziaVPN Security Audit by 7ASecurity appeared first on 7ASecurity Blog.

]]> 7ASecurity completes CoverDrop Audit https://7asecurity.com/blog/2024/06/7asecurity-completes-coverdrop-audit/ Wed, 12 Jun 2024 09:46:20 +0000 About CoverDrop Whistleblowers need a secure method to initiate contact and build trust with journalists. Existing tools often cater to later-stage correspondence, leaving crucial, early touch-points vulnerable to surveillance. In addition, many of these tools are difficult to find on newspaper websites, hard to use securely, and offer insufficient user guidance. After conducting workshops with …

The post 7ASecurity completes CoverDrop Audit appeared first on 7ASecurity Blog.

]]> 7ASecurity Completes Bridgefy Audit https://7asecurity.com/blog/2023/07/bridgefy-audit/ Mon, 31 Jul 2023 11:04:27 +0000 7ASecurity worked with Bridgefy to complete a whitebox pentest of the mobile app, SDK, cloud infrastructure, and privacy to help improve Bridgefy’s overall security posture. What is Bridgefy? Bridgefy, a popular mobile messaging app, allows you to send offline messages by leveraging Bluetooth technology. This app aims to provide secure messaging when infrastructure is not …

The post 7ASecurity Completes Bridgefy Audit appeared first on 7ASecurity Blog.

]]> 7ASecurity Completes ArgoVPN Audit https://7asecurity.com/blog/2023/07/argovpn-audit/ Fri, 28 Jul 2023 09:21:57 +0000 This blog post summarizes a whitebox security review conducted by 7ASecurity against the ArgoVPN platform. What is ArgoVPN? ArgoVPN is a free VPN with an unlimited bandwidth that is developed for Android devices. It allows users to visit blocked websites, online services, social media and messaging apps. The developers designed ArgoVPN to meet the needs …

The post 7ASecurity Completes ArgoVPN Audit appeared first on 7ASecurity Blog.

]]> 7ASecurity Completes Mozilla K-9 Mail Audit https://7asecurity.com/blog/2023/07/mozilla-k-9-mail-audit/ Thu, 20 Jul 2023 11:01:58 +0000 7ASecurity had the privilege to collaborate with the Open Source Technology Improvement Fund (OSTIF), as well as the K-9 Mail and Thunderbird teams at Mozilla, in a recent security audit of the Mozilla K-9 Mail application. What is K-9 Mail? K-9 Mail is an open source email application that runs on most Android devices. Ideally, the application is reliable, intuitive and secure …

The post 7ASecurity Completes Mozilla K-9 Mail Audit appeared first on 7ASecurity Blog.

]]> XMPP MitM attack via PLAIN mechanism https://7asecurity.com/blog/2023/06/xmpp-mitm-attack/ Thu, 08 Jun 2023 08:48:00 +0000 Are you testing MitM of an old protocol that starts using clear-text communications?You should consider spoofing server replies with some downgrade attack! This old trick still works sometimes against protocols that like:XMPP, SMTP, POP3 and others Let’s illustrate this with an XMPP example from the field 🙂 Introduction: In XMPP, credentials are not supposed to …

The post XMPP MitM attack via PLAIN mechanism appeared first on 7ASecurity Blog.

]]> Hacking Mandated Apps – Part 8: Password Leak via API! [ MSTG-AUTH-1 ] https://7asecurity.com/blog/2019/09/hacking-mandated-apps-part-8-password-leak-via-api-mstg-auth-1/ Wed, 11 Sep 2019 03:14:19 +0000 Part 1: Intro Part 2: Translating APKs Part 3: What is SSL? [ MSTG‑NETWORK‑1 ] Part 4: How NOT to implement SSL [ MSTG‑NETWORK‑2 ] Part 5: RCE in WebView [ MSTG-PLATFORM-7 ] Part 6: XOR Crypto FAIL [ MSTG-CRYPTO-1 ] Part 7: AES Crypto FAIL [ MSTG-CRYPTO-1 ] The OWASP Mobile Application Security Verification …

The post Hacking Mandated Apps – Part 8: Password Leak via API! [ MSTG-AUTH-1 ] appeared first on 7ASecurity Blog.

]]> Hacking Mandated Apps – Part 7: AES Crypto FAIL [ MSTG-CRYPTO-1 ] https://7asecurity.com/blog/2019/09/hacking-mandated-apps-part-7-aes-crypto-fail-mstg-crypto-1/ Mon, 09 Sep 2019 03:27:21 +0000 Part 1: Intro Part 2: Translating APKs Part 3: What is SSL? [ MSTG‑NETWORK‑1 ] Part 4: How NOT to implement SSL [ MSTG‑NETWORK‑2 ] Part 5: RCE in WebView [ MSTG-PLATFORM-7 ] Part 6: XOR Crypto FAIL [ MSTG-CRYPTO-1 ] The OWASP Mobile Application Security Verification Standard classifies the flaw explained in this blog …

The post Hacking Mandated Apps – Part 7: AES Crypto FAIL [ MSTG-CRYPTO-1 ] appeared first on 7ASecurity Blog.

]]> Hacking Mandated Apps – Part 6: XOR Crypto FAIL [ MSTG-CRYPTO-1 ] https://7asecurity.com/blog/2019/09/hacking-mandated-apps-part-6-xor-crypto-fail-mstg-crypto-1/ Fri, 06 Sep 2019 01:40:27 +0000 Part 1: Intro Part 2: Translating APKs Part 3: What is SSL? [ MSTG‑NETWORK‑1 ] Part 4: How NOT to implement SSL [ MSTG‑NETWORK‑2 ] Part 5: RCE in WebView [ MSTG-PLATFORM-7 ] The OWASP Mobile Application Security Verification Standard classifies the flaw explained in this blog post, under section V3: Cryptography Requirements, as follows: …

The post Hacking Mandated Apps – Part 6: XOR Crypto FAIL [ MSTG-CRYPTO-1 ] appeared first on 7ASecurity Blog.

]]>