Hey Google, Activate Spyware! When Google Assistant Uses a Vulnerability as a Feature
summary
Demonstrates chained weaknesses and built-in features in Android and Google Assistant that allow remote actors to control a phone and capture photos, video, and geolocation without user awareness, even when the device is locked or the screen is off. Describes a weaponized rogue spy application created by combining several vulnerabilities and platform features, aimed at illustrating exploitation paths and remediation considerations for developers and security teams.
AI-written summary · about
chapters (9)
- 0:00Introduction to research
- 1:18Android intent architecture
- 4:13Finding the vulnerability
- 7:09Establishing persistence
- 8:51Achieving stealthy operation
- 13:13Advanced data extraction
- 17:28Disclosure and resolution
- 21:17Key takeaways
- 22:55Q&A session
related talks
28mHey Google, Activate Spyware! – When Google Assistant Uses a Vulnerability as a Feature
48mSecurity Vulnerabilities in AI Assistant Based Applications
17mSidewinder Targeted Attack Against Android in the Golden Age of Ad Libs
25mSimple Spyware: Android's Invisible Foreground Services and How to (Ab)use Them
40mSecurity: The Hidden Cost of Android Stalkerware
56mModern Android Hacking
32mExploring Android Accessibility Malware
28mExploring Android Accessibility Malware