Attacking the Linux PRNG on Android
summary
Claim: a practical attack reconstructs the Linux non-blocking pool seed on many Android devices given a leaked 16-byte at_random (from zygote) or a leaked IPv6 fragment ID. A proof-of-concept app exfiltrates the leak to a cloud service that runs a cloud-based seed search by simulating millions of RNG states (observed entropy ≈ 24 bits on S4, ≈ 19 bits on S2 — ~16M and ~500k seeds). Result: keystore stack canaries become guessable (≈1% per boot for keystore) and IPv6 fragment IDs are predictable; the PoC works.
AI-written summary · about
chapters (32)
- 0:00Introduction
- 0:13Outline
- 1:02Story
- 2:38Stack Canaries
- 7:20Summary
- 12:37Boot Timeline
- 14:08Contributions
- 15:03Teaser
- 15:58Whitepaper
- 18:25Problems
- 20:36Segmenting
- 22:09Leaks
- 22:29Theoretic
- 23:01Disclaimer
- 25:03What we found
- 25:35Zygote
- 26:26Other
- 27:34Leak
- 29:49Early Boot
- 30:28Probability
- 31:35Demo
- 34:37Cat
- 35:23Boot time leak
- 35:36Kernel boot time leak
- 38:12ipv6 segmentation
- 39:24Scenario
- 40:53Results
- 42:07What can we attack
- 43:11Mitigations
- 45:08Hard R
- 47:07Wrapup
- 49:42Discussion
related talks
54mAnalyzing & Breaking QNX Exploit Mitigations and PRNGs For Embedded Systems
45mInside the Linux Kernel Random Number Generator
01h 30mRandom
44mCryptography Pitfalls
25mPersonalizing Your Random Numbers
30mMy code is being hacked!
58mExploiting Linux and Pax ASLR's Weaknesses on 32-Bit and 64-Bit Systems
27mCLKSCREW: Exposing the Perils of Security-Oblivious Energy Management