Securing the System: A Deep Dive into Reversing Android Pre-Installed Apps
summary
Reverse engineering of pre-installed Android apps focuses on concrete surprises: analysis of more than 1,000 OEM build images reveals why emulator sandboxes fail (signature/privileged perms, sharedUserId, headless apps, custom HALs), exposes a socket+daemon backdoor that uses base64 blobs written to a kernel char device and modified SELinux to run commands, a binder-exposed system service calling runtime.exec that affects 223 builds ~6M users (70% patched in two weeks), and supply‑chain malware like Shinhwa: 20 million devices propagated via preloads and SDKs.
AI-written summary · about
chapters (19)
- 0:00Start
- 17:35Multi-App Collusion
- 24:13Pre-Installed Application Code
- 24:51Daemon #2
- 28:00App's Manifest
- 28:55Executing Commands
- 30:02Sidebar: Interesting Detection Problem
- 31:13Overview
- 31:33Implementation
- 32:26Framework Modifications
- 33:16Sidebar: Analyzing Framework Code
- 35:40Case Study #3: Security Settings Misconfiguration
- 36:35The Problem
- 38:35How to fix?
- 39:48Case Study #2: 3P Botnet
- 40:25Chamois
- 40:37Supply Chain Distribution Methods
- 42:05EagerFonts
- 44:29Remediation
related talks
29mA day in the life of a mobile reverse engineer
29mA Day in the Life of a Mobile Malware Reverse Engineer
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
43mSecurity in Android Applications
33mReverse - Engineering apps on the device - how far can we go?
47mSecuring Android Applications
38mReverse Engineering is not just for hackers