Still Vulnerable Out of the Box
Audits 21 prepaid and 11 unlocked Android smartphones, uncovering privilege escalation, arbitrary file access, and remote command execution in preloaded firmware.
Summary
The Persistent Risks of Prepaid Smartphones
Prepaid Android smartphones sold by major carriers offer affordable hardware, but frequently ship with bloated, unvetted pre-installed software from carriers, chipset vendors, and third parties.
Auditing 32 Carrier and Unlocked Android Devices
Ryan Johnson, Mohamed Elsabagh, and Angelos Stavrou examine the local attack surface across 21 prepaid carrier devices and 11 unlocked handsets purchased from retail stores.
Exploiting Insecure Local Interfaces and Pre-Loaded Apps
Unprivileged third-party apps can exploit unprotected BroadcastReceivers and ContentProviders to execute arbitrary system commands, trigger factory resets, and exfiltrate GPS location data.
Systemic Supply Chain and OEM Accountability
The findings demonstrate systemic failures in OEM and carrier firmware quality control, urging regulators and vendors to enforce strict privilege boundaries on pre-installed applications.
Related talks
Main Stage·44 min
Enrique Nissim · Krzysztof Okupski
Enrique Nissim and Krzysztof Okupski disclose AMDSinkclose, a vulnerability allowing Ring -2 execution and System Management Mode takeover across millions of AMD processors.
Main Stage·39 min
Octavio Gianatiempo · Octavio Galland
Octavio Gianatiempo and Octavio Galland audit top-selling consumer routers, discovering systemic OEM firmware vulnerabilities that enable zero-click remote RCE.
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.