Research

By

About us

Android applications security research
Android applications protection consulting

Team

Dzmitry Lukyanenka - Android applications security researcher (linkedin)
  • 2019: H1-604 Highest Signal in Vancouver, CA (2019)
  • 2019: H1-604 2019 Most Valuable Hacker in Vancouver, CA (2019)
  • 2019: CVE-2019-1995, CVE-2019-9440, CVE-2019-2124
  • 2019: 1st rank in Facebook Whitehat program (before June 2019)
  • 2019: 1st place in Facebook BountyCon Singapore
  • 2018: TOP5 in Facebook Whitehat program (https://web.facebook.com/whitehat/thanks/)
  • 2018: BugBash Miami 2018, 2nd place
  • 2018: rank number 18 in Google VRP
  • 2018: CVE-2018-9459, CVE-2018-9461, CVE-2018-9587
  • 2017: rank number 18 out of almost 400 paid reporters in Google VRP
  • 2017: CVE-2017-0414, CVE-2017-0703, CVE-2017-0808, CVE-2017-13157, CVE-2017-13158, CVE-2017-13159
  • 2016: CVE-2016-1656, CVE-2016-2458

Facebook 1st rank before June 2019



Facebook 2018 TOP 5 (https://web.facebook.com/whitehat/thanks/) :


Media:

Contact

skype: dmitry.lukyanenko

Popular posts from this blog

Facebook Messenger server random memory exposure through corrupted GIF image

By
Image
Intro Year ago, in February 2018, I was testing Facebook Messenger for Android looking how it works with corrupted GIF images. I was inspired by Imagemagick "uninitialized memory disclosure in gif coder" bug and PoC called "gifoeb" (cool name for russian speakers). I found Messenger app only crashes with images generated by "gifoeb" tool with Nullpointer dereferrence (Facebook did't awarded bounty for DoS in Facebook Messenger for Android). Ok. I thought: what is GIF image format and how it looks, how I can generate my own image? (spoiler: 10K$ bug in Facebook Messenger for Web, but theory first)
Read more

React debug.keystore key was trusted by Meta(Facebook) which caused to Instagram account takeover by malicious apps.

By
Image
  App Signing All Android applications should be signed with keys generated by app developers ( https://source.android.com/security/apksigning ). When application signed with specific key we can verify that this app was not modified by thirdparty. Also it is possible to communicate between apps (IPC) and verify app identity by it key signature. If caller app has verified signature than we can allow it to do some restricted actions, for example we can return some confidential information to it like user information. This keys should be confidential and not be exposed outside. Bug Description I played with Facebook Sdk for Android and noticed one thing. This api call is not validates package name when you authorize your client_id ``` https://m.facebook.com/dialog/oauth?android_key= Xo8WBi6jzSxKDVR4drqm84yr9iU &calling_package_key=com.vulnano.android.facebook.sdkat&client_id=124024574287414&display=touch&facebook_sdk_version=8.1.0&redirect_uri=fbconnect%3A%2F%2Fsuccess
Read more

Meta Quest: Attacker could make any Oculus user to follow (subscribe) him without any approval

By
Image
Description Attacker was able to subscribe any Oculus user on attacker's Oculus account without user approval. So it was possible to make very attractive account with a lot of real followers without their approval:). This followers are displayed in Oculus Quest device when you open user profile, also in profile opened in Meta Quest for Android and some other places. Bug details  This page https://secure.oculus.com/my/people/   displays Oculus user followers:  
Read more