Faux Disk Encryption: Realities of Secure Storage On Mobile Devices
summary
Mobile devices store long‑lived tokens and offline caches, and attackers succeed because whole‑stack weaknesses matter: iOS ties file keys to hardware plus a passcode and the secure enclave / Touch ID protects against offline brute force, while Android shows wide OEM fragmentation, inconsistent keystore behavior and slow updates. A practical exploit called Rosie backdoor flashes a custom kernel via download mode in under two minutes and exfiltrates an app SQLite file; tools mentioned include idb and Heimdall, and Marshmallow finally adds stronger keystore and scrypt protections.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:55Outline 1. Introduction
- 9:07iOS Encryption Hierarchy
- 21:49Evolution of Android Security
- 25:33How Android Encryption Works nccgroup
- 28:44Android Credential Storage System Credential Store allows for storage of
- 34:39Importance of Boot Security
- 40:45Flash Recovery
- 41:17Backdoor the Kernel nccgroup
- 41:37Test Exploit 1. Compile backdoored kernal 2. Create boot image 3. Flash boot image via recovery 4. Reboot and test
- 49:44Best Practices for Developers nccgroup General
related talks
45mTen Secrets to Secure Mobile Applications
21mWhen Attackers Go Mobile-First: What Developers Need to Know
36mEnhancing Mobile App Security
22mA Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security
47mSecuring Android Applications, The Right Way
49mContain Yourself: Building Secure Containers for Mobile Devices
34mAuthenticated and Encrypted Storage on Embedded Linux