THE KNOWLEDGE IS THE WORK.
Resources(82)
Remote exploitation of a man-in-the-disk vulnerability in WhatsApp (CVE-2021-24027)
Chariton Karamitas
CENSUS has been investigating for some time now the exploitation potential of Man-in-the-Disk (MitD) vulnerabilities in Android. Recently, CENSUS identified two such vulnerabilities in the popular WhatsApp messenger app for Android. The first of these was possibly independently reported to Facebook and was found to be...
Emulating Hypervisors: a Samsung RKP case study (OffensiveCon 2020)
Aris Thallas
Hello, I'm Aris Thallas, a computer security researcher working at CENSUS. Back in February 2020 I had the pleasure of presenting my work on proprietary hypervisor emulation and bug discovery at the OffensiveCon 2020 conference.
The Known Beacons Attack (34th Chaos Communication Congress)
George Chatzisofroniou
The recent key reinstallation attacks (KRACK) against the WPA2 protocol revealed how an adversary can easily eavesdrop, and in some cases tamper, a Wi-Fi connection secured by the WPA2 protocol. At the same time, Wi-Fi automatic association attacks achieve a similar result (man-in-the-middle position) not by attacking...
Examining the value of SafetyNet Attestation as an Application Integrity Security Control
Anestis Bechtsoudis
Google promotes the SafetyNet Attestation API as a tool to query and assess the integrity status of an Android device. The official documentation, leaves no doubt that the main purpose of the SafetyNet Attestation API is to provide device integrity information to the server counterpart of mobile applications. The...
Shadow v2 public release
Patroklos Argyroudis
About four months ago (April 2017), Vasilis Tsaousoglou and myself presented our work on exploiting Android's libc allocator at the 2017 INFILTRATE conference (Miami, Florida). Since version 5.0, Android has adopted the jemalloc allocator as its default libc malloc(3) implementation. For our talk we extended our...
Android stagefright impeg2d_vld_decode stack buffer overflows
Anestis Bechtsoudis
Android provides a media playback engine at the native level called Stagefright. CENSUS engineers have discovered that the MPEG-2 software decoder invoked by libstagefright has multiple stack buffer overflows at the impeg2d_vld_decode() procedure.
Android stagefright impeg2d_dec_pic_data_thread integer overflow
Anestis Bechtsoudis
Android provides a media playback engine at the native level called Stagefright that comes built-in with software-based codecs for several popular media formats. Stagefright features for audio and video playback include integration with OpenMAX codecs, session management, time-synchronized rendering, transport...
Android stagefright ih264d_read_mmco_commands libavc heap overflow
Anestis Bechtsoudis
Android provides a media playback engine at the native level called Stagefright that comes built-in with software-based codecs for several popular media formats. Stagefright features for audio and video playback include integration with OpenMAX codecs, session management, time-synchronized rendering, transport...
Android stagefright libavc ih264d_decode heap overflow
Anestis Bechtsoudis
Android provides a media playback engine at the native level called Stagefright that comes built-in with software-based codecs for several popular media formats.CENSUS engineers have discovered that the libavcodec H.264 software decoder invoked by libstagefright has an OOB write heap overflow at the...
Android stagefright libmpeg2 impeg2d_dec_user_data heap overflow
Anestis Bechtsoudis
Android provides a media playback engine at the native level called Stagefright that comes built-in with software-based codecs for several popular media formats. CENSUS engineers have discovered that the MPEG-2 software decoder invoked by libstagefright has an out-of-bounds read at the impeg2d_dec_user_data()...
The road to efficient Android fuzzing
Anestis Bechtsoudis
In the aftermath of the recent Android stagefright vulnerabilities, efficient fuzz testing techniques and tools for the Android ecosystem are again in the spotlight. In this post we would like to share some of the fuzz testing experience we have gained through our projects and show how it can be applied in the Android...
Fuzzing Objects d'ART — Hack In The Box 2015 Amsterdam
Anestis Bechtsoudis
Hello, my name is Anestis Bechtsoudis and I'm a security engineer at CENSUS. I recently gave a talk on Android ART runtime fuzzing techniques at the Hack-in-the-Box 2015 Amsterdam security conference. The talk entitled "Fuzzing Objects d'ART — Digging Into the New Android L Runtime Internals", analyzed a series of DEX...