Physical Attacks Against Smartphones

on YouTube ↗36m

" summary

A Chinese OEM 2019 Android fork yields a command injection in recovery filename that, when paired with an exFAT/EXT4 SD payload, disables SELinux, enables ADB and uses ptrace switch_root injection to replace init and pivot into Android, giving root access that survives until reboot; a Samsung Galaxy A4s (Exynos 850) yields a USB descriptor overwrite leading to arbitrary memory R/W via control‑transfer fuzzing, allowing in‑RAM bootloader patching and a secure‑boot bypass; proofs work reliably and Samsung patches the flaw within three months.

AI-written summary · about

" chapters (4)

1. 0:00Physical smartphone attacks
2. 2:11Rooting locked Android via command injection
3. 17:24Exploiting Samsung's secondary bootloader USB stack
4. 35:43Disclosure and conclusion

" related talks

• 23mCharge Your Device with the Latest MalwareAndré Pereira · Black Hat Europe 2014
• 42mD1T2 - Rooting Android 8 with a Kernel Space Mirroring AttackYang Song, Yong Wang · Hack In The Box Amsterdam 2018
• 43mBreaking Samsung's ARM TrustZoneMaxime Peterlin, Alexandre Adamski, Joffrey Guilbon · Black Hat USA 2019
• 48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed AppsMaddie Stone · Black Hat USA 2019
• 23mATtention Spanned: Comprehensive Vulnerability Analysis of AT Commands Within the Android EcosystemLee Harrison, Hayawardh Vijayakumar, Grant Hernandez, Dave (Jing) Tian, Patrick Traynor, Joseph I. Choi, Vanessa Frost, Christie Ruales, Amir Rahmati, Michael Grace, Kevin R. B. Butler · USENIX Security '18
• 22mA Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection AppsHuiming Liu, Xiangqian Zhang · Black Hat Asia 2021
• 41mPrison Break Season 6: Defeating the Mitigations Adopted by Android OEMsTong Lin, Jun Yao · Black Hat Asia 2018
• 35mKSMA: Breaking Android Kernel Isolation and Rooting with ARM MMU FeaturesYang Song, Yong Wang, Chengming Yang, Baozeng Ding · Black Hat Asia 2018