Security through explanation
This AndroidProjectCreator updates the Log4J dependency, which is used by the org.eclipse.jgit dependency, to version 2.16.0. This update is required because CVE-2021-45046 affects 2.15.0. The previous update to version 2.15.0 addressed CVE-2021-44228. AndroidProjectCreator does not use Log4J internally, as it simply writes log messages to the standard output using System.out. The above-mentioned Git dependency gives … Read more
This AndroidProjectCreator update brings a simple yet required change: the the org.eclipse.jgit dependency uses Log4J, which has a severe remote code execution vulnerability in it, tracked as CVE-2021-44228. To avoid needless error messages, AndroidProjectCreator embeds the logger. The Log4J version that is used, has been updated to a version that is not vulnerable anymore, which … Read more
The atHack conference in Saudi Arabia’s Riyadh, where I presented my Mobile Malware Mimicking framework (m3). The event lasted three days, from the 28th of November until and including the 30th. It was the second physical conference I attended since the pandemic started, the first being Black Hat Europe, which I wrote about previously. In … Read more