From 69ca37c3842fba13bff77286ea0cd01431136f87 Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Tue, 18 Aug 2026 06:48:03 +0000 Subject: [PATCH] Add content from: How Bad Binder, a Rogue Update Server, and Frida Compromised... --- .../insecure-in-app-update-rce.md | 53 +++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/src/mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.md b/src/mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.md index 6b676cc51a6..53c2ac972eb 100644 --- a/src/mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.md +++ b/src/mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.md @@ -48,6 +48,55 @@ adb shell run-as sh -c 'find files code_cache no_backup app_* -maxdepth 5 adb shell run-as sh -c 'find files -maxdepth 5 \( -path "*splitcompat*" -o -path "*local_testing*" -o -path "*codepush*" -o -path "*expo*" \) -print 2>/dev/null' ``` +### Trusted updater takeover -> local privilege escalation + +Do not scope an updater review to client-side TLS bugs. The trust boundary also includes authoritative DNS and routing, reverse proxies/load balancers, the update origin, TLS private keys, and the package-signing service/key. If a locked-down device silently polls this infrastructure and auto-installs what it advertises, control of any component that can produce an accepted response turns the updater into a no-click delivery primitive even when browsers and sideloading are disabled. In an authorized lab, capture the complete check-in, metadata, package, signature, version/rollback, and reboot behavior; then reproduce the service and verify whether package authenticity is anchored to a key that remains outside the delivery infrastructure.[[6]](#references) + +This delivery primitive can convert a **local** kernel exploit into a remote chain, but the stages must not be conflated. For example, CVE-2019-2215 (Bad Binder) is a Binder-driver use-after-free that provides local kernel privilege escalation after attacker code is already executing; it is not a remote updater vulnerability. On a vulnerable build, the delivered process can use that primitive to obtain root, weaken SELinux, instrument other UIDs, persist at boot, suppress logs, and prevent later legitimate updates.[[3]](#references)[[6]](#references) + +Audit the chain separately: + +1. **Delivery authenticity:** Can DNS, routing, a load balancer, origin admin, TLS key, or CI/signing service make the client accept a different update? +2. **Execution:** Does the accepted package install an APK, DEX/JAR, native library, init service, or firmware image without user interaction? +3. **Privilege:** Does the shipped OS/kernel expose a local escalation usable from the updater's execution context? +4. **Persistence/recovery:** Does a boot component re-run the escalation, hide artifacts, or block rollback and genuine updates? + +### Endpoint plaintext collection with native Frida hooks + +Root or an equivalent injection primitive lets Frida attach inside the trusted application rather than attack encrypted transport. Select a hook at the plaintext boundary: message construction, serialization, the encrypt/decrypt call, or the database write immediately beside it. `Interceptor.attach()` redirects execution through callbacks that can inspect arguments and return values before normal execution resumes.[[4]](#references)[[6]](#references) + +Realm-backed applications provide useful event triggers. Realm Java exports `Java_io_realm_internal_OsObject_nativeCreateNewObjectWithStringPrimaryKey(JNIEnv *, jclass, jlong, jlong, jlong, jstring)` from `librealm-jni.so`; the final argument is the object's string primary key. Hooking this function identifies row creation, but **the primary key is not necessarily the message body**: use its backtrace and nearby setters/serialization calls to locate the actual plaintext buffer.[[5]](#references)[[6]](#references) + +Minimal event hook (for an application you are authorized to test):[[4]](#references)[[5]](#references) + +```js +const realm = Process.getModuleByName('librealm-jni.so'); +const create = realm.getExportByName( + 'Java_io_realm_internal_OsObject_nativeCreateNewObjectWithStringPrimaryKey' +); +Interceptor.attach(create, { + onEnter(args) { + console.log(`Realm object creation; jstring pk=${args[5]}`); + console.log(Thread.backtrace(this.context, Backtracer.ACCURATE) + .map(DebugSymbol.fromAddress).join('\n')); + } +}); +``` + +Use the backtrace to move the hook toward the application-specific message object or crypto boundary, and correlate one controlled test message with the resulting callbacks. For Frida deployment and Java/native hook patterns, see: + +{{#ref}} +frida-tutorial/README.md +{{#endref}} + +For persistence, C2, log suppression, and collection behavior after Android malware executes, see: + +{{#ref}} +../../generic-methodologies-and-resources/basic-forensic-methodology/android-malware-post-exploitation.md +{{#endref}} + +Defensive validation should correlate both ends of the chain: unexpected updater DNS/routing/load-balancer or certificate changes; packages outside the expected signing/version lineage; root transitions; SELinux leaving enforcing mode; disappearing system/application logs; Frida modules or executable mappings; persistent wake locks; repeated update failures; and event-driven egress immediately after unlocks, messages, media creation, or location changes.[[6]](#references) + --- ## 1. Identifying an Insecure TLS TrustManager @@ -279,5 +328,9 @@ Also consider stubbing vendor methods such as `PluginVerifier.verifySignature()` - [1] [NowSecure – Remote Code Execution Discovered in Xtool AnyScan App](https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/) - [2] [Android Developers – Dynamic Code Loading (risks and mitigations)](https://developer.android.com/privacy-and-security/risks/dynamic-code-loading) +- [3] [Google Project Zero – Bad Binder: Android In-The-Wild Exploit](https://projectzero.google/2019/11/bad-binder-android-in-wild-exploit.html) +- [4] [Frida JavaScript API – Interceptor](https://frida.re/docs/javascript-api/#interceptor) +- [5] [Realm Java – `io_realm_internal_OsObject.cpp`](https://github.com/realm/realm-java/blob/main/realm/realm-library/src/main/cpp/io_realm_internal_OsObject.cpp) +- [6] [Computer Weekly – Cyber spies used malware from GitHub to hack EncroChat cryptophone network](https://www.computerweekly.com/news/366649396/Revealed-Cyber-spies-used-malware-from-GitHub-to-hack-EncroChat-cryptophone-network) {{#include ../../banners/hacktricks-training.md}} \ No newline at end of file