A Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps
summary
Top Android vendors’ “privacy” apps (Secure Folder, PrivateSpace, Safe, App Lock) contain concrete failures: weak encryption like AES‑ECB with keys derived from IMEI/MAC or XOR, Trusted Execution misuse that returns plaintext passwords from the TEE, fingerprint and SMS reset flows that allow bypass, and multi‑user/ADB exploits that install or replace apps and pull files via pm/am/content commands. Four exploitable classes are demonstrated with adb and content tools, data is exfiltrated in demos, and most issues were reported and later patched.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:38Overview
- 6:18Vulnerability Examples
- 14:09Secure Folder
- 14:42Android Mac User
- 16:01Android MultiUser
- 19:45Advice Mitigation
- 20:24Conclusion
related talks
43mSecurity in Android Applications
29mSecuring Android Applications - The not so se…
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
24mModern Android App Security: Protecting Code, Keys, and Data
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
40mSecurity: The Hidden Cost of Android Stalkerware