security bulletin Archives

AppWizard

April 19, 2025

Urgent Android Warning: Major Security Flaw Allows Hackers Full Access—Here Are the Apps You Must Delete Now

A vulnerability known as “Dirty Stream” was discovered by Microsoft, allowing malicious applications to hijack trusted apps on high-end Android devices. Although the flaw has been patched, any data accessed before the patch remains vulnerable. The vulnerability exploited the ContentProvider system in Android, enabling harmful apps to send deceptive files that could overwrite critical data in secure storage. Microsoft noted that this could lead to arbitrary code execution, giving attackers full control over applications and access to sensitive user data. Several popular Android apps were found to be vulnerable, with over four billion installations affected. It is crucial to promptly install security updates and maintain app vigilance to protect personal data.

AppWizard

March 25, 2025

NSA warned of vulnerabilities in Signal app a month before Houthi strike chat

The National Security Agency (NSA) issued an operational security bulletin in February 2025, warning employees about vulnerabilities in the encrypted messaging application Signal. This alert followed an incident where Defense Secretary Pete Hegseth accidentally shared sensitive war plans in a Signal chat shortly before U.S. military operations in Yemen. The bulletin labeled Signal as a high-value target for interception and highlighted the sophistication of Russian hacking groups using phishing tactics to breach encrypted conversations. NSA personnel were instructed not to share sensitive information via third-party messaging applications and to avoid connections with unknown individuals. National Intelligence Director Tulsi Gabbard and CIA Director John Ratcliffe testified before a Senate panel, affirming that no classified information was exchanged in the chat, but the NSA emphasized that even unclassified information should not be shared on Signal. Ratcliffe defended Signal as an approved communication tool, while both officials denied knowledge of operational details related to the military strike.