Loading video...

Video Failed to Load

Go Home

Stealing authentication token from Basecamp Android app using deep link Vulnerability analysis: via Daniel h1 report:

androidmalware2's profile picture

Mobile Hacker

60,382 subscribers

29,928 views • 3 years ago •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

Introducing your universal stablecoin account Tuyo The banking app from the future enabling instant, multichain trading of over 15,000 tokens — powered by Relay ⚡ Available today in the App Store and via waitlist for Android users.
0:15

Introducing your universal stablecoin account Tuyo The banking app from the future enabling instant, multichain trading of over 15,000 tokens — powered by Relay ⚡ Available today in the App Store and via waitlist for Android users.

Relay

19,049 views • 9 months ago

asked Hermes Agent and OpenClaw to scrape our site and send a report. using DeepSeek V4 from our API. OpenClaw: 15k token, 2min 48 sec. wrote a bash script. Hermes: 36 token, 8 min 06 sec. wrote a SKILL.md. runs itself next time.
0:10

asked Hermes Agent and OpenClaw to scrape our site and send a report. using DeepSeek V4 from our API. OpenClaw: 15k token, 2min 48 sec. wrote a bash script. Hermes: 36 token, 8 min 06 sec. wrote a SKILL.md. runs itself next time.

GMI Cloud

49,602 views • 3 months ago

MoonPay Trade is now live via Ledger Wallet™ ⚡️ fast cross-chain token conversion 💪 institutional grade order trading 💦 competitive rates with minimal slippage 🔐 verified using Clear Signing tech available today in your Ledger Wallet™ app
0:18

MoonPay Trade is now live via Ledger Wallet™ ⚡️ fast cross-chain token conversion 💪 institutional grade order trading 💦 competitive rates with minimal slippage 🔐 verified using Clear Signing tech available today in your Ledger Wallet™ app

MoonPay 🟣

18,401 views • 1 month ago

🔵 INTRODUCING: DAILY REWARDS! Been using JumpTask App on your Android? It’s your lucky day! We are introducing Daily Rewards - open JumpTask daily and claim your $0.01 reward! But that’s not all 😉 From today, open JumpTask App and claim your daily rewards for 7 days straight and get a chance to win $10! Don’t have JumpTask App on your Android device? No worries, you can download it here ➡️
0:18

🔵 INTRODUCING: DAILY REWARDS! Been using JumpTask App on your Android? It’s your lucky day! We are introducing Daily Rewards - open JumpTask daily and claim your $0.01 reward! But that’s not all 😉 From today, open JumpTask App and claim your daily rewards for 7 days straight and get a chance to win $10! Don’t have JumpTask App on your Android device? No worries, you can download it here ➡️

JumpTask

107,950 views • 2 years ago

The Bluwhale Roadmap: 6 Months to Disruption 🐳 We aren't just building another platform; we’re disrupting your day-to-day financial life. The Sprint: 🗓 Jan: NFT Reveal 📱 Feb: Android App Launch 🪙 Mar: Agent Token Launch 🍎 Apr: iOS App Launch 🤖 June: Agent AppStore V2 The Vision (2026+): Deep bank integrations, financial agent expansion & robotics. Personalized 24/7 AI service is the future. Let’s march forward. 🌊
0:11

The Bluwhale Roadmap: 6 Months to Disruption 🐳 We aren't just building another platform; we’re disrupting your day-to-day financial life. The Sprint: 🗓 Jan: NFT Reveal 📱 Feb: Android App Launch 🪙 Mar: Agent Token Launch 🍎 Apr: iOS App Launch 🤖 June: Agent AppStore V2 The Vision (2026+): Deep bank integrations, financial agent expansion & robotics. Personalized 24/7 AI service is the future. Let’s march forward. 🌊

Bluwhale

54,168 views • 8 months ago

🚨XRP HOLDERS YOU HAVE TO KNOW THIS🚨 ONE OF THE BIGGEST BANKS IN CHINA CONSIDERS USING #XRP ACCORDING TO A BANKING INSIDE!! EVERYTHING WILL BE ON THE XRP LEDGER WHERE XRP WILL SERVE AS THE BRIDGE!! THIS IS ALSO WHY THE TOP DEFI TOKEN ON THE #XRPL, CTF TOKEN, WILL SKYROCKET!! LITERALLY $20 BILLION MARKET CAP SENDS CTF token from $0.90 to $748.50 per token!! CTF token trade link on DEX: Buy on MEXC: Website:
0:15

🚨XRP HOLDERS YOU HAVE TO KNOW THIS🚨 ONE OF THE BIGGEST BANKS IN CHINA CONSIDERS USING #XRP ACCORDING TO A BANKING INSIDE!! EVERYTHING WILL BE ON THE XRP LEDGER WHERE XRP WILL SERVE AS THE BRIDGE!! THIS IS ALSO WHY THE TOP DEFI TOKEN ON THE #XRPL, CTF TOKEN, WILL SKYROCKET!! LITERALLY $20 BILLION MARKET CAP SENDS CTF token from $0.90 to $748.50 per token!! CTF token trade link on DEX: Buy on MEXC: Website:

FinanceBro

42,919 views • 1 year ago

100,000+ Downloads on Android: One of the Fastest Growing Crypto Apps 👩‍🚀 Moon App is growing every day, with 100,000+ app downloads on Android. Users automate their trading with leading strategies & powerful bots work for them. But what's the best way to be early on the Moon Mission? We developed a token economy where early adopters benefit from adoption of the trading app. Download Moon App and start accumulating points. Trading & Fundraising Infrastructure for a Leading Blockchain 🥮 Moon App is working with a leading innovator in web3 - one of the fastest growing blockchains. We are building advanced trading bots infrastructure on the network. Partner reveal soon.
0:13

100,000+ Downloads on Android: One of the Fastest Growing Crypto Apps 👩‍🚀 Moon App is growing every day, with 100,000+ app downloads on Android. Users automate their trading with leading strategies & powerful bots work for them. But what's the best way to be early on the Moon Mission? We developed a token economy where early adopters benefit from adoption of the trading app. Download Moon App and start accumulating points. Trading & Fundraising Infrastructure for a Leading Blockchain 🥮 Moon App is working with a leading innovator in web3 - one of the fastest growing blockchains. We are building advanced trading bots infrastructure on the network. Partner reveal soon.

RWAX $APP

405,362 views • 2 years ago

0-days exploited by #Predator spyware were delivered via man-in-the-middle (MITM) attack and 0-click vulnerability against #iOS and #Android In the video below, I demonstrated how an attacker - using just smartphone - can trigger DNS spoofing attack to redirect device on the same wi-fi network to attacker controlled website. Such domain could deliver phishing or 0-day as in the case of Predator's browser exploit
0:18

0-days exploited by #Predator spyware were delivered via man-in-the-middle (MITM) attack and 0-click vulnerability against #iOS and #Android In the video below, I demonstrated how an attacker - using just smartphone - can trigger DNS spoofing attack to redirect device on the same wi-fi network to attacker controlled website. Such domain could deliver phishing or 0-day as in the case of Predator's browser exploit

Mobile Hacker

436,139 views • 2 years ago

I finally did it. I can literally code while driving using speech to text. Expo running via tunnel. Remote tmux hooked up to opencode, live app edits streamed directly to and from my phone. This changes everything.
0:10

I finally did it. I can literally code while driving using speech to text. Expo running via tunnel. Remote tmux hooked up to opencode, live app edits streamed directly to and from my phone. This changes everything.

Peter Piekarczyk (🥧🚗🐥)

27,671 views • 8 months ago

The latest loophole that third-party file manager apps were using to get access to files and folders under /Android/data and /Android/obb has been patched. As part of Android 11's Scoped Storage restrictions, apps that use the Storage Access Framework (SAF) to launch the documents picker are not supposed to be able to get access to files and folders under the /Android/data or /Android/obb directories. However, third-party file managers figured out that if they set the initial directory when launching the documents picker to either /Android/data or /Android/obb, the documents picker lets the user grant the app full access to directories. This loophole was patched in Android 13, but then another loophole was discovered that got around this. Since Android 13 only blocked apps from setting /Android/data or /Android/obb as the initial directory when launching the documents picker, it was quickly discovered that you could set the initial directory to one of the subdirectories under /Android/data or /Android/obb, thus the user could grant access to individual subdirectories one-by-one. However, this latest loophole was patched with a recent Google Play System Update. The latest version of the DocumentsUI app, the Project Mainline module that comprises the documents picker, now restricts the initial location for the ACTION_OPEN_DOCUMENT/_TREE intent so that apps cannot request the initial location to be one of /Android/data, /Android/sandbox, /Android/obb, or one of their subdirectories. If the DocumentsUI app (AKA 'Files' app) on your device is on version 14-10492947 (version code 340916000), then this loophole is patched.
0:15

The latest loophole that third-party file manager apps were using to get access to files and folders under /Android/data and /Android/obb has been patched. As part of Android 11's Scoped Storage restrictions, apps that use the Storage Access Framework (SAF) to launch the documents picker are not supposed to be able to get access to files and folders under the /Android/data or /Android/obb directories. However, third-party file managers figured out that if they set the initial directory when launching the documents picker to either /Android/data or /Android/obb, the documents picker lets the user grant the app full access to directories. This loophole was patched in Android 13, but then another loophole was discovered that got around this. Since Android 13 only blocked apps from setting /Android/data or /Android/obb as the initial directory when launching the documents picker, it was quickly discovered that you could set the initial directory to one of the subdirectories under /Android/data or /Android/obb, thus the user could grant access to individual subdirectories one-by-one. However, this latest loophole was patched with a recent Google Play System Update. The latest version of the DocumentsUI app, the Project Mainline module that comprises the documents picker, now restricts the initial location for the ACTION_OPEN_DOCUMENT/_TREE intent so that apps cannot request the initial location to be one of /Android/data, /Android/sandbox, /Android/obb, or one of their subdirectories. If the DocumentsUI app (AKA 'Files' app) on your device is on version 14-10492947 (version code 340916000), then this loophole is patched.

Mishaal Rahman

17,039 views • 2 years ago

Built a fully native, SwiftUI app for tracking our son’s naps and distributed it via TestFlight to my wife, over a few hours all from my phone(!!!) using Bitrig. It’s obviously not the best app in the world, but it’s fun and uses some iOS 26 APIs + modern components:
0:28

Built a fully native, SwiftUI app for tracking our son’s naps and distributed it via TestFlight to my wife, over a few hours all from my phone(!!!) using Bitrig. It’s obviously not the best app in the world, but it’s fun and uses some iOS 26 APIs + modern components:

Jordan Borth

18,718 views • 9 months ago

Exciting news! Bing is now integrated into SwiftKey on Android and iOS. Search, chat and rewrite messages using Bing from any app. As someone who communicates daily in my non-native language, the tone feature is a great tool for adapting my words to the style of the conversation.
0:14

Exciting news! Bing is now integrated into SwiftKey on Android and iOS. Search, chat and rewrite messages using Bing from any app. As someone who communicates daily in my non-native language, the tone feature is a great tool for adapting my words to the style of the conversation.

Jordi Ribas

68,714 views • 3 years ago

🚀 Qwen3.8-Max from Alibaba Cloud is now live on Novita—an official Day-0 launch partner. A 2.4T-parameter MoE flagship built for coding and knowledge work, with native visual understanding and deep analysis for long-context tasks. • 1M-token context window • OpenAI-compatible serverless API • Function calling, reasoning, structured output, and Anthropic API support #BuildWithQwen
0:16

🚀 Qwen3.8-Max from Alibaba Cloud is now live on Novita—an official Day-0 launch partner. A 2.4T-parameter MoE flagship built for coding and knowledge work, with native visual understanding and deep analysis for long-context tasks. • 1M-token context window • OpenAI-compatible serverless API • Function calling, reasoning, structured output, and Anthropic API support #BuildWithQwen

Novita AI

32,017 views • 11 days ago

Why NOTMEME? 🤖🤔 @notmeme_app is reshaping the future of AI-powered meme trading: ✅ Automated trading and token creation. ✅ Real-time analysis of the meme coin market. ✅ Cross-chain support for $SOL, $ETH, and $TON. ✅ Seamless access via telegram mini-app-no complex setup required. NOTMEME AI Agents is here to change how meme coins are created and traded. ➡️ Secure your spot now:
0:16

Why NOTMEME? 🤖🤔 @notmeme_app is reshaping the future of AI-powered meme trading: ✅ Automated trading and token creation. ✅ Real-time analysis of the meme coin market. ✅ Cross-chain support for $SOL, $ETH, and $TON. ✅ Seamless access via telegram mini-app-no complex setup required. NOTMEME AI Agents is here to change how meme coins are created and traded. ➡️ Secure your spot now:

GAMEFI.ORG

103,804 views • 1 year ago

The VeChain party goes on! 🪩 Another day, another Tap to Pay transaction. And just look at those snacks we bought with $VET 😋 📱 PS: Oobit is now LIVE for Android users from the EU - download the app with the link in our bio! #Vetap #GetOobit
0:17

The VeChain party goes on! 🪩 Another day, another Tap to Pay transaction. And just look at those snacks we bought with $VET 😋 📱 PS: Oobit is now LIVE for Android users from the EU - download the app with the link in our bio! #Vetap #GetOobit

Oobit

22,948 views • 2 years ago

🚨 $NOTMEME IDO IS LIVE – GET YOUR TOKEN NOW The $NOTMEME IDO is now officially live on @notmeme_app is pioneering a new era of AI-driven trading - featuring automated token creation, real-time meme market analysis, and seamless access via a Telegram mini-app. ➡️ Grab your $NOTMEME: 🕞 Sale time: 03:00 UTC, June 24 - 09:00 UTC, June 25 🔴 Refund Policy: 24 hours to request ✅ Price: $0.00002 per $NOTMEME ✅ Token Network: Solana ✅ IMC: $415,000 ✅ FDV: $2,000,000 ✅ Vesting: 50% unlock at TGE, monthly release for 6 months Don’t miss your chance to join the next-gen Memepad revolution!
0:10

🚨 $NOTMEME IDO IS LIVE – GET YOUR TOKEN NOW The $NOTMEME IDO is now officially live on @notmeme_app is pioneering a new era of AI-driven trading - featuring automated token creation, real-time meme market analysis, and seamless access via a Telegram mini-app. ➡️ Grab your $NOTMEME: 🕞 Sale time: 03:00 UTC, June 24 - 09:00 UTC, June 25 🔴 Refund Policy: 24 hours to request ✅ Price: $0.00002 per $NOTMEME ✅ Token Network: Solana ✅ IMC: $415,000 ✅ FDV: $2,000,000 ✅ Vesting: 50% unlock at TGE, monthly release for 6 months Don’t miss your chance to join the next-gen Memepad revolution!

GAMEFI.ORG

74,783 views • 1 year ago

Get ready for a powerhouse of insights at #Consensus2025! 🔥 We're thrilled to announce more incredible speakers: → The future of IP onchain with at Story → The innovative leadership of Jelena Djuric at Noble → The global vision of Evan Auyang at Animoca Brands → Deep market analysis from Daniel Blackmore at glassnode See the full, growing lineup 🔗 ⤵️
0:12

Get ready for a powerhouse of insights at #Consensus2025! 🔥 We're thrilled to announce more incredible speakers: → The future of IP onchain with at Story → The innovative leadership of Jelena Djuric at Noble → The global vision of Evan Auyang at Animoca Brands → Deep market analysis from Daniel Blackmore at glassnode See the full, growing lineup 🔗 ⤵️

Consensus by CoinDesk

22,667 views • 1 year ago

🚨 Breaking News: Record illegal sewage dumping 🚨 Our latest report—produced with Prof. Peter Hammond of Windrush Against Sewage Pollution—has revealed 140 days with illegal sewage spilling from the six sites around Windermere in 2024 alone. You’ll hear United Utilities cry that the analysis is wrong—but they've failed to provide any evidence to disprove any of the illegal spills revealed in this report. The BBC asked them to explain why it was incorrect. They couldn’t—or wouldn’t—do it. The full report can be found by following the link below
0:13

🚨 Breaking News: Record illegal sewage dumping 🚨 Our latest report—produced with Prof. Peter Hammond of Windrush Against Sewage Pollution—has revealed 140 days with illegal sewage spilling from the six sites around Windermere in 2024 alone. You’ll hear United Utilities cry that the analysis is wrong—but they've failed to provide any evidence to disprove any of the illegal spills revealed in this report. The BBC asked them to explain why it was incorrect. They couldn’t—or wouldn’t—do it. The full report can be found by following the link below

MattStaniek

18,308 views • 1 year ago

OpenClaw Releases iOS and Android Companion Node Apps That Connect a Phone to a Self-Hosted AI Agent Gateway Most "AI assistant" apps are a chatbot in a sandbox, calling someone else's API. OpenClaw's iOS and Android apps draw a very clear line away from that model. They're companion nodes, not standalone apps. Each phone pairs to a self-hosted OpenClaw Gateway over a WebSocket (default port 18789) with role: "node". The Gateway — the single control plane for sessions, routing, channels, and events — runs on macOS, Linux, or Windows (WSL2). The phone gives the agent a body: camera, location, voice, notifications, and a live Canvas. Here's what's actually interesting: → The assistant runs on your machine — chat messages land on the Gateway, never on the phone → Nodes expose a command surface (canvas., camera., device., notifications., system.*) through node.invoke → Privacy-heavy commands like camera.snap and screen.record stay off until you allowlist them via gateway.nodes.allowCommands → Camera and screen capture run foreground-only; pairing needs explicit approval (openclaw devices approve) → Both store listings declare no data collection; ws:// is LAN-only, remote needs a wss:// TLS endpoint via Tailscale Full analysis: Android app: iOS App: OpenClaw🦞
0:18

OpenClaw Releases iOS and Android Companion Node Apps That Connect a Phone to a Self-Hosted AI Agent Gateway Most "AI assistant" apps are a chatbot in a sandbox, calling someone else's API. OpenClaw's iOS and Android apps draw a very clear line away from that model. They're companion nodes, not standalone apps. Each phone pairs to a self-hosted OpenClaw Gateway over a WebSocket (default port 18789) with role: "node". The Gateway — the single control plane for sessions, routing, channels, and events — runs on macOS, Linux, or Windows (WSL2). The phone gives the agent a body: camera, location, voice, notifications, and a live Canvas. Here's what's actually interesting: → The assistant runs on your machine — chat messages land on the Gateway, never on the phone → Nodes expose a command surface (canvas., camera., device., notifications., system.*) through node.invoke → Privacy-heavy commands like camera.snap and screen.record stay off until you allowlist them via gateway.nodes.allowCommands → Camera and screen capture run foreground-only; pairing needs explicit approval (openclaw devices approve) → Both store listings declare no data collection; ws:// is LAN-only, remote needs a wss:// TLS endpoint via Tailscale Full analysis: Android app: iOS App: OpenClaw🦞

Marktechpost AI

38,812 views • 1 month ago

This app uses AirDrop to send files from your Android phone to your Macbook! Yes, it actually uses AirDrop. That means you don't have to install ANYTHING on your Mac to send files from your Android phone! Here's a video of a Galaxy Z Flip 5 AirDropping a file to a Macbook running macOS Ventura 13.5.1. (Thanks to u/FragmentedChicken for testing this app for me and sharing the video!) A few months ago, Twitter user @Linus13499209 brought an app called WarpShare to my attention. WarpShare is an app made by the developers of MoKee, an AOSP-based custom ROM that was popular in China. Since MoKee wasn't as popular outside of China, it seems the existence of their WarpShare app slipped under the radar. I was skeptical about whether it would work at all. Grishka, the developer of NearDrop, an open source port of Google's Nearby Share to macOS, told me that they were under the assumption that AirDrop requires the use of AWDL (Apple Wireless Direct Link, Apple's proprietary WiFi-based protocol) to communicate both ways. However, it seems that AWDL is only required for your Android phone to be discoverable by your Mac (ie. to send files from your Mac to your Android phone) but not the other way around. Because of this, though, WarpShare only supports sending files from Android to Mac but not vice versa. Your Mac also needs to have AirDrop discoverability set to "everyone" for this to work, as "contacts-only" requires Apple-signed certificates. Plus, it also doesn't support sending files from Android to iPhones or iPads, even when "everyone" mode is enabled. Still, if you find other Android --> Mac file sharing options to be lackluster, give WarpShare a try! The fact that it works at all is incredible, which is why I'm sharing this news here. If you want to download WarpShare on your Android device, you'll need to compile the app from its source code. If you're a Patron/X subscriber, however, I will share my compiled APK with you. WarpShare source code:
0:16

This app uses AirDrop to send files from your Android phone to your Macbook! Yes, it actually uses AirDrop. That means you don't have to install ANYTHING on your Mac to send files from your Android phone! Here's a video of a Galaxy Z Flip 5 AirDropping a file to a Macbook running macOS Ventura 13.5.1. (Thanks to u/FragmentedChicken for testing this app for me and sharing the video!) A few months ago, Twitter user @Linus13499209 brought an app called WarpShare to my attention. WarpShare is an app made by the developers of MoKee, an AOSP-based custom ROM that was popular in China. Since MoKee wasn't as popular outside of China, it seems the existence of their WarpShare app slipped under the radar. I was skeptical about whether it would work at all. Grishka, the developer of NearDrop, an open source port of Google's Nearby Share to macOS, told me that they were under the assumption that AirDrop requires the use of AWDL (Apple Wireless Direct Link, Apple's proprietary WiFi-based protocol) to communicate both ways. However, it seems that AWDL is only required for your Android phone to be discoverable by your Mac (ie. to send files from your Mac to your Android phone) but not the other way around. Because of this, though, WarpShare only supports sending files from Android to Mac but not vice versa. Your Mac also needs to have AirDrop discoverability set to "everyone" for this to work, as "contacts-only" requires Apple-signed certificates. Plus, it also doesn't support sending files from Android to iPhones or iPads, even when "everyone" mode is enabled. Still, if you find other Android --> Mac file sharing options to be lackluster, give WarpShare a try! The fact that it works at all is incredible, which is why I'm sharing this news here. If you want to download WarpShare on your Android device, you'll need to compile the app from its source code. If you're a Patron/X subscriber, however, I will share my compiled APK with you. WarpShare source code:

Mishaal Rahman

1,290,362 views • 3 years ago