Man in the Binder: He Who Controls IPC, Controls the Droid
summary
Demonstrates a working POC rootkit that, once a device is rooted (TowerRoot-style exploits available up to KitKat), injects native code into a target process (PID 974) and wins three stealth attacks: a keylogger by hooking the binder ioctl, transaction tampering (changing destination to 1337 and amount 100,000 → 900,000) by capturing and editing parcels, and SMS theft by reading cursor FD from the telephony DB. Recommends encrypting IPC, in-process keyboards, and memory-scanning defenses.
AI-written summary · about
chapters (9)
- 0:00Introduction to Android Attacks
- 3:24Android Architecture Overview
- 5:58How Binder Works
- 8:28Attack Act 1: Keylogging
- 12:17Attack Act 2: Transaction Fraud
- 17:26Transaction Fraud Demo
- 19:48Attack Act 3: SMS Interception
- 24:16Binder Hooking Technique
- 26:45Defense and Q&A
related talks
53mAndroid: He protec, but he also attac
49mContain Yourself: Building Secure Containers for Mobile Devices
31mAll your Root Checks Belong To Us: The Sad State of Root Detection
40mAndroid Rootkits: Analysis from Userland and Kernelland
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security
42mD1T2 - Rooting Android 8 with a Kernel Space Mirroring Attack
41mPrison Break Season 6: Defeating the Mitigations Adopted by Android OEMs
49mAll Your Code Belongs To Us (Dismantling Android Secrets With CodeInspect)