Harvesting Inconsistent Security Configurations in Custom Android ROMs...

on YouTube ↗25m

" summary

Differential analysis over 591 images from 11 vendors using the tool droid diff finds widespread security configuration mismatches: hundreds of permissions change protection levels (often normal vs signature), three downgraded gids (system, camera, media) appear, and protected broadcasts or component visibility differ across ROMs. The work clusters by model/version/carrier, reports a duplicate-component bug to Google, and builds real exploits that read email, reboot or factory‑reset phones, send SMS, or access drivers without proper privileges.

AI-written summary · about

" chapters (20)

1. 0:00Intro
2. 1:26Android Fragmentation: Facts
3. 2:06Android Fragmentation: Effects
4. 2:51Literature on Customization Security Effects
5. 4:15Generalization of Existing Customization Hazards
6. 5:12DroidDiff: Systematic identification of all configuration changes introduced during customization.
7. 5:55How can we compare the security configurations at each layer?
8. 8:03Feature Extraction Summary of all features
9. 8:22Permissions
10. 12:28Component Visibility
11. 13:04Component Protection
12. 13:26Data Generation
13. 13:50Differential Analysis Purpose
14. 14:46Responsible Party
15. 16:06Findings: Overall Situation
16. 16:54Potential Dangerous Patterns Behind the Inconsistencies
17. 17:21Permission changes patterns
18. 19:11Permission-GID mapping changes pattern: GIDs privileges might be downgraded
19. 19:50Discovery of duplicate components bug
20. 21:04Discovered Attacks

" related talks

• 49mD2T1 - Uncovering the Android Patch GapKarsten Nohl, Jakob Lell · Hack In The Box Amsterdam 2018
• 48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed AppsMaddie Stone · Black Hat USA 2019
• 22mA Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection AppsHuiming Liu, Xiangqian Zhang · Black Hat Asia 2021
• 43mSecurity in Android ApplicationsAleksandr Smirnov · РИТ++ 2016
• 58mResearching Android Device Security with the Help of a Droid ArmyJoshua 'jduck' Drake · Black Hat USA 2014
• 24mDangerous Hare: Hanging Attribute References Hazards Due to Vendor CustomizationNan Zhang · Black Hat USA 2016
• 29mSecuring Android Applications - The not so se…Bessie Jiang, Desnos Anthony · DroidKaigi 2023
• 48mChallenges in Android Supply Chain AnalysisŁukasz Siewierski · RSA Conference 2020 DevSecOps & Application Security