NERDS.xyz โ Real Tech News for Real NerdsGoogle clamps down on Android developers with mandatory verification
https://fed.brid.gy/r/https://nerds.xyz/2026/03/android-developer-verification/
๐ฏ๐๐๐๐๐ ๐ฎ๐ณDay 10 of #100VibeProjects ๐
Built a local web tool that does static security analysis of Android APKs โ upload an APK and get a report covering permissions, hardcoded secrets, SDK fingerprinting, cert pinning, and crypto posture.
The interesting part: the methodology came from reverse-engineering the WhiteHouse app teardown that went viral last week. Applied the same five-gate analysis framework to a real banking app.
Found an expired certificate pin (silently disables TLS pinning for all users), a session replay SDK with no confirmed masking rules, and four Adobe tracking SDKs doing cross-device user stitching.
The tool runs entirely locally. No data leaves your machine. APK deleted after analysis.
Stack: Python ยท Flask ยท androguard ยท 380 lines
๐ Blog: mrdee.in
https://mrdee.in/writing/vibecoding-day010-offline-apk-security-analyzer/
๐ป GitHub Repo: https://github.com/mr-dinesh/Offline-APK-Analyzer
#VibeCoding #AppSec #AndroidSecurity #MobileSecurity #Python #Flask #DFIR #InfoSec #ReverseEngineering #CyberSecurity
Vibecoding-Day010-Create offline web tool for static security analysis of Android APK files
Building an Offline APK Security Analyzer in Flask Project #10 of the 100 Vibe Coding Projects challenge Iโve been doing APK security analysis manually for years โ pulling the file, running jadx, grepping through decompiled source, eyeballing the manifest. It works, but itโs slow and the output lives in a terminal window that disappears the moment you close it. This weekโs project: wrap that entire methodology into a local web tool. Upload an APK, get a structured risk report in your browser. No internet required, nothing stored, APK deleted the moment analysis completes.
TechnoTenshi 
Sam Bent reports the White House app v47.0.1 requests 26 Android permissions, including precise location, biometric authentication, storage changes, startup, overlay, and Wi-Fi access, and embeds 3 trackers including Huawei Mobile Services Core. The piece also says the app includes an ICE tip line link and a "Text the President" feature that prefills "Greatest President Ever!" while collecting contact details. More broadly, the article compares permissions and trackers across U.S. government apps including FEMA, myFBI Dashboard, IRS2Go, and CBP Mobile Passport Control and argues many functions could be delivered via the web instead of mobile apps.
https://www.sambent.com/the-white-house-app-has-huawei-spyware-and-an-ice-tip-line/
Zevonix๐ถ Cyber Tip: Turn off Bluetooth when not in use.
Disabling it reduces the risk of unauthorized connections and device based attacks.
BSidesLuxembourgJust Announced for BSides Luxembourg 2026!
Lightning Talk โก ๐จ๐ก๐๐๐ฅ๐ฆ๐ง๐๐ก๐๐๐ก๐ ๐ ๐ข๐๐๐๐ ๐ฆ๐ง๐๐๐๐๐ฅ๐ช๐๐ฅ๐ - ๐๐๐ข๐จ๐๐ก ๐ฅ๐๐๐๐จ๐ง
Elouan Rigaut https://linkedin.com/in/elouan-rigaut is a security researcher focused on mobile threats and surveillance technologies. His work examines stalkerware, attacker behavior, and detection challenges, with an emphasis on real-world impact and emerging research gaps.
๐
Conference Dates: 6โ8 May 2026 | 09:00โ18:00
๐ 14, Porte de France, Esch-sur-Alzette, Luxembourg
๐๏ธ Tickets: https:// 2026.bsides.lu/tickets/
๐
Schedule Link: https://pretalx.com/bsidesluxembourg-2026/schedule/
#BsidesLuxembourg #CyberSecurity #MobileSecurity #Privacy #Stalkerware #InfoSec
๐ Cyber Tip: Enable biometric logins on mobile devices.
Fingerprint or facial recognition adds an extra layer of protection if your device is lost or stolen.
OWASP FoundationFor the first time ever, OWASP MAScon hits OWASP Global AppSec EU 2026 in Vienna! Join top experts for cutting-edge mobile security talks, live demos & real-world insights.
๐ Tickets: https://owasp.glueup.com/event/owasp-global-appsec-eu-2026-vienna-austria-162243/tickets.html
๐ Details: https://owaspglobalappseceuvienna20.sched.com/overview/type/MobileAppSecCon
knoppixThe DarkSword iOS exploit, targeting Safari and WebKit, has leaked publicly on GitHub. โ ๏ธ
Apple patched affected devices with iOS 26.3, 18.7.3, 16.7.15, and 15.8.7, but unpatched devices remain at risk. ๐
#TechNews #iOS #MobileSecurity #Privacy #FOSS #OpenSource #UserControl #SoftwareUpdate #CyberSecurity #Exploit #Patch #UpdateNow #iPhone #iPad #SecurityAlert #DarkSword #Hacking #Safari #WebKit #GitHub
TechNaduSurfshark launches HeyPolo ๐
โข No always-on tracking
โข Share exact / approx / none
โข Granular visibility controls
Privacy-first location sharing.
https://www.technadu.com/surfshark-introduces-privacy-focused-location-app-heypolo/624213/
FriendlyDealer scam abusing PWAs:
โข 1,500+ fake app store domains
โข Browser-based installs bypass OS checks
โข Apps appear legit
โข Fake MrBeast affiliations used
Shift to stealth mobile delivery.
