Resurrecting The Read_Logs Permission on Samsung Devices
summary
Researchers show a practical exploit that forces Samsung devices to emit world‑readable dumps containing Android and kernel logs by abusing /system/bin/dumpstate; an unprivileged app that holds android.permission.RECEIVE_BOOT_COMPLETED can schedule a JNI fork/abort to trigger dump generation and then read notifications, SMS, Messenger/WhatsApp texts, GPS and account identifiers. The method works across 12 Samsung builds (Galaxy S1→S5, Note 3/4 range), produces 3–6 MB gzip dumps, and the proof‑of‑concept successfully extracts sensitive notification text.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:58android.permission.READ_LOGS
- 3:13Why regain READ_LOGS perm
- 6:09Notifications in the Android Log
- 7:21Write all the sensitive data to the log
- 8:59Regaining Android Log Access
- 9:57Three Different Bricks
- 10:32dumpstate binary
- 11:09Error in native code
- 12:33Dumpstate Files on Samsung Android
- 13:07data/log directory
- 13:37dumpstate file snippet
- 14:26Create exploit application
- 17:22Samsung vs AOSP Notifications
- 17:52Notification ManagerServer
- 19:03Vulnerable Builds
- 19:52Android Platform Usage
- 20:33Threat Mitigation
- 22:16Conclusion
- 23:13Questions and Discussion
related talks
36mPhysical Attacks Against Smartphones
32mHacking the Hackers’ Code: Inside Android Malware
47mUnderstanding IMSI Privacy
23mCharge Your Device with the Latest Malware
37mDebugging Android Devices in the Field
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
56mModern Android Hacking
26mStart Arbitrary Activity App Components as the System User Vulnerability Affecting Samsung Android