Hey, Your Parcel Looks Bad - Fuzzing and Exploiting Parcel -Ization Vulnerabilties in Android
summary
Binder IPC accepts crafted parcels and fuzzing plus code audit uncovers BadParcel flaws that let a zero‑permission app gain code execution in mediaserver and system_server on Android 6.0. Custom native and Java fuzzers generate malformed parcel streams, the team integrates ASAN on Android 6 to triage memory bugs and attempts AFL integration, finds several high‑severity crashes, and converts an index out‑of‑bounds info‑leak into reliable PC control using heap spray and memory feng shui to get a shell.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:55Tencent KEEN Security Lab
- 3:13Binder in Android - Advantages (cont.)
- 6:08Key of the heart: Binder (cont.)
- 9:58Conclusion
- 11:50Data booking and unboxing in Java
- 15:47Fuzzing strategies of Java land (cont.)
- 17:06Integration with ASAN
- 20:31Example 1 (cont.)
- 24:32Exploitability Analysis
- 25:39Vector item
- 26:40Strong Pointer (cont.)
- 28:36We still need heap fengshui
related talks
39mAndroid Parcels: The Bad, the Good and the Better - Introducing Android's Safer Parcel
45mFuzzing Android: A Recipe For Uncovering Vulnerabilities Inside System Components In Android
30mDoes your Android app expose you to excess risk?
29mMy Other ClassLoader is Your ClassLoader Reloaded: Reviving Parcelable Objects
29mSecuring Android Applications - The not so se…
22mA Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps
53mDIFUZE: Android Kernel Driver Fuzzing
35mDeep into Android Bluetooth Bug Hunting: New Attack Surfaces and Weak Code Patterns