Security: The Hidden Cost of Android Stalkerware
summary
Analysis covers 86 Android apps analyzed, gathered from Play Store installs and other sources, with 158 exploitable issues found in 58 apps (67%) and over 140,000 installs from Google Play. Concrete failures include unencrypted HTTP uploads, sensitive files left on external storage, exposed admin APIs and open directories, SMS command control and hard‑coded livestream endpoints that let anyone trigger audio/video by device ID. Device forensics can recover stalker credentials in 64% of apps and only 12% of vendors patched flaws after disclosure.
AI-written summary · about
chapters (13)
- 0:00Start
- 5:20Platform
- 5:52App analysis plan
- 7:14Limited functionality test
- 12:44User Pll leak on server
- 13:11Sends user Pll to server before registration or login
- 14:13Victim data forgery
- 16:43Ability to start arbitrary components
- 17:22Data stays on server after account is removed
- 19:06Allows remote control via admin panel
- 20:13Hardcoded secrets
- 23:42Fixing issues
- 24:40Conclusion
related talks
43mSecurity in Android Applications
22mA Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps
35mWhere Do We Go From Here? Stalkerware, Spouseware etc
20mDemystifying the Android Telehealth Ecosystem
30m"Latest Android threats and their techniques"
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
36mRevisiting Stealthy Sensitive Information Collection from Android Apps
41mOverview of common Android app vulnerabilities