Charge Your Device with the Latest Malware
summary
Vendor Android USB interfaces accept AT and proprietary commands over USB on some Samsung and HTC models, exposing a path to flashing a compromised boot partition via Odin and download mode. The exploit chain uses devices with ADB left enabled (~20% estimated), swaps a ramdisk init to force persistent ADB enablement, drops su and a nonremovable system app like AndroRAT as system app, and then gains root and silent persistence without user consent.
AI-written summary · about
chapters (11)
- 0:00Start
- 2:03Dangers of physical attacks through USB
- 4:00Radio Interface Layer
- 7:08Attack scenario
- 8:12Architecture
- 10:35Having the AT command interface.
- 11:06Flashing a compromised boot partition with "AT+FUS?"
- 11:36Structure of the boot partition
- 13:473 Install an uninstallable surveillance application
- 14:49Tested Antivirus apps.
- 17:48Conclusion
related talks
36mPhysical Attacks Against Smartphones
23mATtention Spanned: Comprehensive Vulnerability Analysis of AT Commands Within the Android Ecosystem
32mHacking the Hackers’ Code: Inside Android Malware
42mThe Ways Hackers Are Taking To Win The Mobile Malware Battle
36mOut Of The Box Exploitation Breaking The Trust Chain Of The Ethereum Phone
44mBehind the Scenes: How Criminal Enterprises Pre-infect Millions of Mobile Devices
46mMod your Android
15mExploiting Android Apps with Counterfeit Art