Bypassing Android Permissions from All Protection Levels
Nikita Kurtin uncovers universal Android permission bypass vulnerabilities affecting over 98% of active devices, subverting signature and privileged protection levels.
Summary
The Android Permission Architecture and Protection Levels
Android's security model relies on permission levels—normal, dangerous, signature, and privileged—to restrict access to sensitive device APIs, hardware, and user data.
Analyzing IPC Flaws and Binder Proxy Confusion
Nikita Kurtin explores inter-process communication (IPC) vulnerabilities in system services, demonstrating how unprivileged apps confuse Binder proxy identity tokens.
Bypassing Signature-Level Permissions Across Android Releases
Kurtin demonstrates step-by-step exploit chains that allow untrusted third-party apps to access location, camera, and system settings without user consent.
Platform Hardening and IPC Validation in AOSP
The author reviews Google's upstream Android Open Source Project (AOSP) patches and provides mobile developers with secure Binder verification patterns.
Related talks
Main Stage·47 min
Qidan He
Discloses new Intent redirection vulnerabilities in modern Android frameworks that bypass destination checks to achieve LaunchAnyWhere privilege escalation.
Main Stage·47 min
Qidan He
Demonstrates novel Intent redirection and LaunchAnyWhere privilege escalation techniques in modern Android platform frameworks.
OffensiveCon·31 min
Maddie Stone
20 - Maddie Stone - Bad Binder: Finding an Android In The Wild 0day.