Hey Google, Activate Spyware! – When Google Assistant Uses a Vulnerability as a Feature
summary
Research finds Android camera intents that let any app without specific camera permission trigger capture and recording by exploiting no permissions exported activities in Google Camera, affecting potentially hundreds of millions of devices. A proof‑of‑concept rogue app called spike cell uses an implicit intent to start video, switch to front camera, and take a three‑second timer photo, mutes the shutter by repeatedly lowering volume, leverages the proximity sensor to record calls in pocket or at the face, then harvests EXIF for geotag tracking. Google and Samsung push a patch and a CVE.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 1:00Android Terminology
- 1:40Hey Google Take a Selfie
- 2:33Intents
- 3:55Permissions
- 5:10Summary
- 5:50Analyzing exported activities
- 7:22Not looking for permission checks
- 8:57Creating a rogue application
- 10:25Persistence
- 11:58Application
- 14:10Hacking the Phone
- 15:33The Screen
- 17:24Back to the List
- 17:40Location Metadata
- 19:13Rogue Application
- 20:10Proximity Sensor Activation
- 21:49What Hackers Really Want
- 22:07Disclosure Timeline
- 23:44Other Android Vendors
- 25:37Google Response
- 27:05Conclusion
related talks
25mHey Google, Activate Spyware! When Google Assistant Uses a Vulnerability as a Feature
48mSecurity Vulnerabilities in AI Assistant Based Applications
25mSimple Spyware: Android's Invisible Foreground Services and How to (Ab)use Them
40mSecurity: The Hidden Cost of Android Stalkerware
26mStart Arbitrary Activity App Components as the System User Vulnerability Affecting Samsung Android
56mModern Android Hacking
24mRecent Mobile App Security Incidents from Real-World Cases
17mSidewinder Targeted Attack Against Android in the Golden Age of Ad Libs