Hacking the Hackers’ Code: Inside Android Malware
summary
Live demo runs on a Samsung S23 (not rooted) where an app requests Accessibility permission, waits ~40 minutes, then captures username, password (even masked fields) and 2FA codes, reads package and app names, and sends the data to a remote server (observed sent twice). Static signs are INTERNET and QUERY_ALL_PACKAGES permissions plus an AccessibilityService and heavy obfuscation; dynamic analysis uses APKTool, JADX, Frida to find callbacks, hook the string-sending method, and prototype a mitigation that whitelists trusted input and intercepts accessibility events.
AI-written summary · about
chapters (6)
- 0:00Android malware via accessibility
- 3:24Attacker’s malware capabilities
- 6:18Static reverse with APKTool
- 13:53Dynamic analysis with Jadx and Frida
- 27:54Defending against accessibility malware
- 30:50Malware analysis tools
related talks
32mExploring Android Accessibility Malware
20mExploring Android Accessibility Malware
28mExploring Android Accessibility Malware
42mThe Ways Hackers Are Taking To Win The Mobile Malware Battle
56mModern Android Hacking
34mWhen Accessibility Uses Us Back — Attacks and Defenses Involving Malware and Accessibility
45mI just hacked your app!
26mAccessibility Service Malwares