Android FakeID Vulnerability Walkthrough
summary
A flaw in Android certificate handling lets a malicious app inject a fake certificate chain and gain privileged identities on devices shipped since January 2010, enabling sandbox escape and data theft. Exploit generation is trivial — 13 lines of Python build a bogus chain that impersonates a trusted cert such as the Adobe certificate hardcoded into WebKit, and a demo yields five apps compromised via a drozer C2; KitKat 4.4 removes the WebKit vector, and patches and a scanner are available.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 1:40PKI Basics
- 3:28SelfSigned Certificates
- 4:19Root Certificate Authority
- 5:19Certificate Chain
- 8:07OSP Code
- 9:54Cryptographic Relationship
- 11:00Selfsigned cert
- 12:22What can you do
- 13:20What we found
- 16:48How to build an exploit
- 19:02Onlive example
- 19:50Live example
- 20:00Evil app
- 20:26Evil app installation
- 20:41Evil app execution
- 20:53Backchannel payload
- 22:57App installation
- 24:53Drozer
- 25:09Example
- 27:20What to do
- 27:50Free BlueBox Security Scanner
- 28:09Security Hygiene
- 29:23Outro
related talks
45mI just hacked your app!
48mChain of Fools: An Exploration of Certificate Chain Validation Mishaps
15mExploiting Android Apps with Counterfeit Art
43mSecurity in Android Applications
22mA Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps
56mModern Android Hacking
20mWhat billions of device ids reveal about Android app abuse
45mI just hacked your app!