How Bad Binder, a Rogue Update Server, and Frida Compromised...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://computerweekly.com/news/366649396/Revealed-Cyber-spies-used-malware-from-GitHub-to-hack-EncroChat-cryptophone-network
• Blog Title: How Bad Binder, a Rogue Update Server, and Frida Compromised EncroChat
• Suggested Section: Mobile Pentesting > Android Applications Pentesting > Insecure In-App Update RCE and Frida Tutorial; cross-reference Android Malware Post-Exploitation and add CVE-2019-2215/Bad Binder under Android privilege escalation or rooting techniques

🎯 Content Summary

Overview and attack chain

French government hacking teams compromised EncroChat's locked-down Android phones in 2020 by chaining control of the trusted update path, Android/Linux kernel privilege escalation through CVE-2019-2215 (Bad Binder), and process instrumentation with Frida. The resulting implant obtained persistent root, disabled SELinux and logging, instrumented the EncroChat application, and exfiltrated plaintext ...

🔧 Technical Details

Turning a local exploit into remote compromise through trusted updates: A locked-down device may prohibit browsers, sideloading, and arbitrary applications while still silently trusting an update service. Control of the update server, DNS, routing, load balancer, hosting environment, TLS credentials, or signing process can therefore provide initial access. Reconstruct or impersonate the expected service, advertise a malicious package as a legitimate update, and allow the device's automatic updater to deliver it without user interaction. The EncroChat chain used a network load balancer and a replica of update.encrochat.ch.

Kernel escalation through a use-after-free: CVE-2019-2215 leaves a stale reference to freed memory in the Android Binder kernel driver. Exploitation reclaims the freed region with controlled content and triggers the dangling reference so the kernel processes attacker-controlled data. The resulting root privileges...

🤖 Agent Actions

Updated:

src/mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.md

Added:

• Trusted update-infrastructure takeover methodology.
• Bad Binder’s role as a local privilege-escalation stage.
• Frida endpoint plaintext instrumentation.
• Realm JNI row-creation hook example.
• Cross-references to existing Frida and Android malware pages.
• Technical detection guidance and numbered primary references.

Validation passed for Markdown structure, citations, internal links, forbidden sources, diff formatting, and JavaScript syntax. mdbook was unavailable in the environment.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://computerweekly.com/news/366649396/Revealed-Cyber-spies-used-malware-from-GitHub-to-hack-EncroChat-cryptophone-network

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting > Insecure In-App Update RCE and Frida Tutorial; cross-reference Android Malware Post-Exploitation and add CVE-2019-2215/Bad Binder under Android privilege escalation or rooting techniques".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0