Challenges in Android Supply Chain Analysis

on YouTube ↗48m

" summary

Examines how Android system images differ from standalone apps when doing supply-chain analysis, focusing on real-world mistakes and pitfalls that arise from the ecosystem of SoC vendors, OEMs, carriers and other parties. Uses examples from Android system images and decompiled Java code to illustrate where common assumptions about sandboxing and attack surface break down.

AI-written summary · about

" chapters (14)

1. 0:00RSAConference 2020
2. 2:43The journey of an Android device
3. 5:57Approval process for Android devices
4. 9:50It started with an application
5. 17:48Dynamic analysis - challenges
6. 21:10Triada history
7. 22:33Backdooring the AOSP log function
8. 25:38Complex communication mechanisms
9. 29:26How to make static analysis work?
10. 31:58Two ways to pass the commands
11. 36:13Dialer app creates commands
12. 40:52Are all the apps on /system preinstalled?
13. 42:29Summary: preinstalled statistics for 2019
14. 43:11Researchers

" related talks

• 48mChallenges in Android Supply Chain AnalysisŁukasz Siewierski · RSA Conference 2020: Mobile & IoT Security
• 41mPreparing for Supply Chain AttacksRyuNen344 · DroidKaigi 2024
• 25mHarvesting Inconsistent Security Configurations in Custom Android ROMs...Xiao Zhang, Yousra Aafer, Wenliang Du · USENIX Security '16
• 48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed AppsMaddie Stone · Black Hat USA 2019
• 43mSecurity in Android ApplicationsAleksandr Smirnov · РИТ++ 2016
• 34mDemystifying Android SecurityPeter Organa · AndroidTO 2017
• 01h 08mAndroid Plateform AnatomyBenjamin Zores · Droidcon Paris 2013
• 29mSecuring Android Applications - The not so se…Bessie Jiang, Desnos Anthony · DroidKaigi 2023