Exploiting Android Apps with Counterfeit Art

on YouTube ↗15m

" summary

Demonstrates turning arbitrary file-overwrite into persistent code execution by replacing an app’s ART image; builds two exploits: a local ASLR-leak chain that corrupts ART C++ artMethod entry points during LZ4 decompression to escalate an untrusted app to system, and a remote relocation/DEX injection that crafts an art image whose relocation fixes function pointers and embeds Dalvik bytecode to run system, proven on OnePlus Backup and a Galaxy S24 Pwn2Own variant.

AI-written summary · about

" chapters (6)

1. 0:00Android app exploitation
2. 1:03Android ART image files
3. 3:41Local attack hijacking
4. 7:11Remote attack leveraging
5. 12:50OnePlus backup exploit
6. 13:53Demonstration findings

" related talks

• 53mHiding Behind Android Runtime (ART)Paul Sabanal · Black Hat Asia 2015
• 45mI just hacked your app!Marcos Placona · NDC Oslo 2018
• 48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed AppsMaddie Stone · Black Hat USA 2019
• 43mAttacking Android ApplicationsDario Incalza · Droidcon Italy 2017
• 47mAttacking Android ApplicationsDario Inalza · 360|AnDev 2017
• 53mAndroid: He protec, but he also attacAleksandr Guzenko · Mobius 2018 Moscow
• 32mApp-etite for Destruction: a look into the cookbook of an attackerIngmar Dasseville · droidcon Berlin 2023
• 36mI just hacked your app!Marcos Placona · GDG DevFest Ukraine 2017