Unix Domain Socket: A Hidden Door Leading to Privilege Escalation in the Android Ecosystem
summary
UDS endpoints in vendor daemons expose real attack paths: 12 issues across four vendors (three acknowledged) show misconfiguration, invalid access control, integer overflow (CVE-2020-0553) and OOB writes that allow arbitrary-address writes and shell→system escalation. Analysis uses ss/netstat enumeration, SELinux policy and IC-search to map allowed domains, CodeQL for static taint scans, and ADB+Python tooling to auto-enumerate sockets. Proof-of-concept exploits use an exported debugger UI as a proxy and successfully gain system privileges.
AI-written summary · about
chapters (13)
- 0:00Start
- 0:38Agenda
- 1:28Unix Domain Socket
- 2:19Types & Namespaces
- 3:15Android API (JAVA)
- 4:25Access control
- 6:10Usage Scenarios
- 6:51UDS in Log Management
- 7:49Vendor Logd Architecture
- 9:10UDS in Exception Management
- 12:26GPS Architecture
- 13:39Features of UDS Service
- 15:20Common vulnerabilities
related talks
45mThe Art of Exploiting Unconventional Use-after-free Bugs in Android Kernel
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
07m"The significance of mobile exploit applications"
44mExposing Critical Threats In Millions Of Connected Devices
48mMobile Device Mismanagement
53mThe Art of Defense - How Vulnerabilities Help Shape Security Features and Mitigations in Android
01h 00mDemonstrating Binary Exploitation
58mDemonstrating binary exploitation