Challenges in Android Supply Chain Analysis
summary
Examines how Android system images — built by SoC vendors, OEMs, carriers and others — differ from standalone apps and why common assumptions fail when analyzing them. Uses real-world examples to highlight pitfalls in supply-chain analysis and shows what to watch for when inspecting system-level components and decompiled Java code.
AI-written summary · about
chapters (14)
- 0:00RSAConference 2020
- 2:43The journey of an Android device
- 5:57Approval process for Android devices
- 9:50It started with an application
- 17:48Dynamic analysis - challenges
- 21:10Triada history
- 22:33Backdooring the AOSP log function
- 25:38Complex communication mechanisms
- 29:26How to make static analysis work?
- 31:58Two ways to pass the commands
- 36:13Dialer app creates commands
- 40:52Are all the apps on /system preinstalled?
- 42:29Summary: preinstalled statistics for 2019
- 43:11Researchers
related talks
48mChallenges in Android Supply Chain Analysis
41mPreparing for Supply Chain Attacks
25mHarvesting Inconsistent Security Configurations in Custom Android ROMs...
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
01h 08mAndroid Plateform Anatomy
22mAndroid Security, an enterprise perspective
40mChallenges of an open source operating system
34mDemystifying Android Security