How Bad Binder, a Rogue Update Server, and Frida Compromised...

src/mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.md

@@ -48,6 +48,55 @@ adb shell run-as <pkg> sh -c 'find files code_cache no_backup app_* -maxdepth 5
 adb shell run-as <pkg> sh -c 'find files -maxdepth 5 \( -path "*splitcompat*" -o -path "*local_testing*" -o -path "*codepush*" -o -path "*expo*" \) -print 2>/dev/null'
 ```
 
+### Trusted updater takeover -> local privilege escalation
+
+Do not scope an updater review to client-side TLS bugs. The trust boundary also includes authoritative DNS and routing, reverse proxies/load balancers, the update origin, TLS private keys, and the package-signing service/key. If a locked-down device silently polls this infrastructure and auto-installs what it advertises, control of any component that can produce an accepted response turns the updater into a no-click delivery primitive even when browsers and sideloading are disabled. In an authorized lab, capture the complete check-in, metadata, package, signature, version/rollback, and reboot behavior; then reproduce the service and verify whether package authenticity is anchored to a key that remains outside the delivery infrastructure.<sup>[[6]](#references)</sup>
+
+This delivery primitive can convert a **local** kernel exploit into a remote chain, but the stages must not be conflated. For example, CVE-2019-2215 (Bad Binder) is a Binder-driver use-after-free that provides local kernel privilege escalation after attacker code is already executing; it is not a remote updater vulnerability. On a vulnerable build, the delivered process can use that primitive to obtain root, weaken SELinux, instrument other UIDs, persist at boot, suppress logs, and prevent later legitimate updates.<sup>[[3]](#references)[[6]](#references)</sup>
+
+Audit the chain separately:
+
+1. **Delivery authenticity:** Can DNS, routing, a load balancer, origin admin, TLS key, or CI/signing service make the client accept a different update?
+2. **Execution:** Does the accepted package install an APK, DEX/JAR, native library, init service, or firmware image without user interaction?
+3. **Privilege:** Does the shipped OS/kernel expose a local escalation usable from the updater's execution context?
+4. **Persistence/recovery:** Does a boot component re-run the escalation, hide artifacts, or block rollback and genuine updates?
+
+### Endpoint plaintext collection with native Frida hooks
+
+Root or an equivalent injection primitive lets Frida attach inside the trusted application rather than attack encrypted transport. Select a hook at the plaintext boundary: message construction, serialization, the encrypt/decrypt call, or the database write immediately beside it. `Interceptor.attach()` redirects execution through callbacks that can inspect arguments and return values before normal execution resumes.<sup>[[4]](#references)[[6]](#references)</sup>
+
+Realm-backed applications provide useful event triggers. Realm Java exports `Java_io_realm_internal_OsObject_nativeCreateNewObjectWithStringPrimaryKey(JNIEnv *, jclass, jlong, jlong, jlong, jstring)` from `librealm-jni.so`; the final argument is the object's string primary key. Hooking this function identifies row creation, but **the primary key is not necessarily the message body**: use its backtrace and nearby setters/serialization calls to locate the actual plaintext buffer.<sup>[[5]](#references)[[6]](#references)</sup>
+
+Minimal event hook (for an application you are authorized to test):<sup>[[4]](#references)[[5]](#references)</sup>
+
+```js
+const realm = Process.getModuleByName('librealm-jni.so');
+const create = realm.getExportByName(
+  'Java_io_realm_internal_OsObject_nativeCreateNewObjectWithStringPrimaryKey'
+);
+Interceptor.attach(create, {
+  onEnter(args) {
+    console.log(`Realm object creation; jstring pk=${args[5]}`);
+    console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
+      .map(DebugSymbol.fromAddress).join('\n'));
+  }
+});
+```
+
+Use the backtrace to move the hook toward the application-specific message object or crypto boundary, and correlate one controlled test message with the resulting callbacks. For Frida deployment and Java/native hook patterns, see:
+
+{{#ref}}
+frida-tutorial/README.md
+{{#endref}}
+
+For persistence, C2, log suppression, and collection behavior after Android malware executes, see:
+
+{{#ref}}
+../../generic-methodologies-and-resources/basic-forensic-methodology/android-malware-post-exploitation.md
+{{#endref}}
+
+Defensive validation should correlate both ends of the chain: unexpected updater DNS/routing/load-balancer or certificate changes; packages outside the expected signing/version lineage; root transitions; SELinux leaving enforcing mode; disappearing system/application logs; Frida modules or executable mappings; persistent wake locks; repeated update failures; and event-driven egress immediately after unlocks, messages, media creation, or location changes.<sup>[[6]](#references)</sup>
+
 ---
 ## 1. Identifying an Insecure TLS TrustManager
 
@@ -279,5 +328,9 @@ Also consider stubbing vendor methods such as `PluginVerifier.verifySignature()`
 
 - [1] [NowSecure – Remote Code Execution Discovered in Xtool AnyScan App](https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/)
 - [2] [Android Developers – Dynamic Code Loading (risks and mitigations)](https://developer.android.com/privacy-and-security/risks/dynamic-code-loading)
+- [3] [Google Project Zero – Bad Binder: Android In-The-Wild Exploit](https://projectzero.google/2019/11/bad-binder-android-in-wild-exploit.html)
+- [4] [Frida JavaScript API – Interceptor](https://frida.re/docs/javascript-api/#interceptor)
+- [5] [Realm Java – `io_realm_internal_OsObject.cpp`](https://github.com/realm/realm-java/blob/main/realm/realm-library/src/main/cpp/io_realm_internal_OsObject.cpp)
+- [6] [Computer Weekly – Cyber spies used malware from GitHub to hack EncroChat cryptophone network](https://www.computerweekly.com/news/366649396/Revealed-Cyber-spies-used-malware-from-GitHub-to-hack-EncroChat-cryptophone-network)
 
 {{#include ../../banners/hacktricks-training.md}}