How Getting a Free Phone Got Me to Report Critical Vulnerabilities

In this presentation for DEF CON 30 DCGVR, mobile security researcher Jonathan Bar Or details how inspecting a complimentary Android smartphone led to the discovery of critical vulnerabilities in pre-installed carrier diagnostic applications. He begins at 08:00 by analyzing the security implications of Android WebViews, explaining the extreme risk of granting embedded web views native JavaScript interfaces without strict domain restrictions.

Jonathan walks through reverse engineering the device's pre-installed Device Health companion app at 16:00, identifying exported Android activities and internal IPC response handlers that failed to enforce origin validation. At 24:00, he demonstrates how an unprivileged local application or malicious webpage could trigger the Device Health browser activity through crafted intents to access restricted operating system functions.

Diving deeper into Android IPC mechanisms at 32:00, Jonathan illustrates how arbitrary input parameters passed through WebViews allowed command injection into native privileged daemon services at 40:00. He concludes at 48:00 by recounting the coordinated vulnerability disclosure process, contrasting proactive carriers that remediated the issues promptly with vendors that required extensive proof-of-concept demonstrations before acknowledging severe risk to millions of deployed devices. (AI summary — Gemini Flash)