Physical Attacks Against Smartphones

Android devices are constantly improving their security to protect against attackers with physical access, with new protection techniques being added year-by-year. This talk aims to demonstrate vulnerabilities in modern Android smartphones that are still viable, despite the mitigations in place.

In the first phase of this talk, we will discuss the analysis and exploitation of vendor-customized versions of Android's Recovery mode, demonstrating weaknesses that allow for privilege escalation to root, and traversal from Recovery to Android, without Bootloader access....

By: Christopher Wade

Full Abstract and Presentation Materials:https://www.blackhat.com/us-23/briefings/schedule/#physical-attacks-against-smartphones-32485

#Android #Vulnerabilities #RecoveryMode #Exploit #PrivilegdeEscalation #Root

#Android 15 Developer Preview released - What's New?

https://www.cnx-software.com/2024/02/17/android-15-developer-preview-released-whats-new/

HeliBoard

#HeliBoard is a privacy-conscious and customizable open-source #android #keyboard, based on AOSP / OpenBoard. Does not use internet permission, and thus is 100% offline.

https://github.com/Helium314/HeliBoard

https://github.com/Helium314/HeliBoard/releases

https://apt.izzysoft.de/fdroid/index/apk/helium314.keyboard

Features
Add dictionaries for suggestions and spell check
build your own, or get them here, or in the experimental section (quality may vary)
additional dictionaries for emojis or scientific symbols can be used to provide suggestions ("emoji search")
note that for Korean layouts, suggestions only work using this dictionary, the tools in the dictionary repository are not able to create working dictionaries
Customize keyboard themes (style, colors and background image)
can follow the system's day/night setting on Android 10+ (and on some versions of Android 9)
can follow dynamic colors for Android 12+
Customize keyboard layouts (only when disabling use system languages)
Multilingual typing
Glide typing (only with closed source library)
library not included in the app, as there is no compatible open source library available
can be extracted from GApps packages ("swypelibs"), or downloaded here
if you are concerned about security implications of loading user-provides libraries, please use the nouserlib build variant, which removes this option. If HeliBoard is installed as system app, and swypelibs are available for the system, they will be used.
If the app is installed as a system app and swypelibs are available, glide typing will be available independent of the version.
Clipboard history
One-handed mode
Split keyboard (if the screen is large enough)
Number pad
Backup and restore your learned word / history data

Bypassing the “run-as” debuggability check on Android via newline injection | Meta Red Team X –

An attacker with ADB access to an Android device can trick the “run-as” tool into believing any app is debuggable. By doing so, they can read and write private data and invoke system APIs as if they were most apps on the system—including many privileged apps, but not ones that run as the system user. Furthermore, they can achieve persistent code execution as Google Mobile Services (GMS) or as apps that use its SDKs by altering executable code that GMS caches in its data directory.

Google assigned the issue CVE-2024-0044 and fixed it in the March 2024 Android Security Bulletin, which becomes public today. Most device manufacturers received an advance copy of the Bulletin a month ago and have already prepared updates that include its fixes.

#Infosec #Vulnerabilities #CVE #Android #ADB

Coper / Octo - A Conductor for Mobile Mayhem… With Eight Limbs? | Team Cymru

Coper, a descendant of the Exobot malware family, was first observed in the wild in July 2021, targeting Colombian Android users. At that time, Coper (the Spanish translation of “Copper”) was distributed as a fake version of Bancolombia’s “Personas'' application.

The malware offers a variety of advanced features, including keylogging, interception of SMS messages and push notifications, and control over the device's screen. It employs various injects to steal sensitive information, such as passwords and login credentials, by displaying fake screens or overlays. Additionally, it utilizes VNC (Virtual Network Computing) for remote access to devices, enhancing its surveillance capabilities.

#Android #MAS #Exobot #Keylogging #Malware #RemoteAccess #SMS #Coper #Octo

Attacking Android

"In this comprehensive guide, we delve into the world of Android security from an offensive perspective, shedding light on the various techniques and methodologies used by attackers to compromise Android devices and infiltrate their sensitive data. From exploiting common coding flaws to leveraging sophisticated social engineering tactics, we explore the full spectrum of attack surfaces present in Android environments."

#Android #Infosec #Vulnerabilities

AutoSpill: Zero Effort Credential Stealing from Mobile Password Managers

We will present a novel attack - that we call AutoSpill - to steal users' saved credentials from PMs during an autofill operation on a login page loaded inside an app. AutoSpill violates Android's secure autofill process. We found that the majority of top Android PMs were vulnerable to AutoSpill; even without JavaScript injections. With #JavaScriptInjections enabled, all of them were found vulnerable. We discovered the fundamental reasons for AutoSpill and will propose systematic countermeasures to fix AutoSpill properly. We responsibly disclosed our findings to the affected PMs and Android security team. Different PMs and Google accepted our work as a valid issue.

By: Ankit Gangwal , Shubham Singh , Abhijeet Srivastava

Full Abstract and Presentation Materials

#Android #Vulnerabilities #PasswordManager #AutoSpill

Universal Android Debloater Next Generation

Cross-platform GUI written in Rust using ADB to debloat non-rooted #Android devices. Improve your privacy, the security and battery life of your device.

https://github.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation

This is a detached fork of the UAD project, which aims to improve privacy and battery performance by removing unnecessary and obscure system apps. This can also contribute to improving security by reducing the attack surface.

Wiki
https://github.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation/wiki

Download
https://github.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation/releases

#debloater #uadng

KernelSU

A kernel-based #root solution for #Android

https://kernelsu.org/guide/installation.html

https://github.com/tiann/KernelSU

@KernelSU
@KernelSU_group