All your Root Checks Belong To Us: The Sad State of Root Detection
summary
Static analysis of popular consumer and enterprise Android security/MDM apps finds most root checks are trivial: looking for /system/xbin/su, PATH entries, specific package names, test-keys, writable mounts or UID zero. Four vendors show no checks; two vendors use native libs but without hardening. A library-hooking tool based on LD_PRELOAD library hooking and a defender called AndroPoser defeats checks by faking open/stat and tracerpid results; common bypasses include rootcloak/exposed.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:17Agenda
- 1:11Context
- 3:57Root Devices
- 6:31Java
- 7:38Tools
- 8:45Results
- 13:00General Device Settings
- 14:02Root Checks
- 16:38Root Check Results
- 17:53Root Clock
- 20:55AirWatch
- 24:25Library hooking
- 25:39Conclusion
- 27:15What we learned
- 29:20Questions
related talks
27mDetecting Android Root Exploits by Learning from Root Providers
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
53mAndroid: He protec, but he also attac
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
43mSecurity in Android Applications
01h 07mHow to attack (and secure) an Android app: an introduction
21mWhen Attackers Go Mobile-First: What Developers Need to Know
40mAndroid Rootkits: Analysis from Userland and Kernelland