CanSecWest 2022 has ended
Back To Schedule
Friday, May 20 • 17:30 - 18:30
Mystique Hits: Vulnerability Chain that breaks the Android Application Sandbox

Log in to save this to your schedule, view media, leave feedback and see who's attending!

Feedback form is now closed.
The Android Application Sandbox is the cornerstone of the Android Security Model, which protects and isolates each application’s process and data from the others. Attackers usually need kernel vulnerabilities to escape the sandbox, which by themselves proved to be quite rare and difficult due to emerging mitigations and attack surfaces tightened. However, we found a vulnerability in the Android 11 stable that breaks the dam purely from userspace, which is CVE-2021-0691. Combined with other 0days (CVE-2021-25450, CVE-2021-25485, CVE-2021-25510, CVE-2021-25511 and CVE-2021-23243 etc) we discovered in major Android vendors forming a chain, a malicious attacker app can totally bypass the Android Application Sandbox, owning any other applications such as Facebook and WhatsApp, reading application data, injecting code or even trojanize the application (including unprivileged and privileged ones) without user awareness. We named the chain "Mystique" after the famous Marvel Comics character due to the similar ability it possesses. These findings have been acknowledged and fixed by Google and major Android vendors such as Samsung. In this talk we will give a detailed walkthrough on the whole vulnerability chain and bugs included. On the attack side, we will discuss the bugs in detail and share our exploitation method and framework that enables privilege escalation, transparently process injection/hooking/debugging and data extraction for various target applications based on "Mystique". We will also share insights on our static program data-flow analysis framework that automatically identifies large portion of bugs in this chain on multiple vendors. On the defense side, we will talk about the detection SDK/tool for app developers and end users since this new type of attack differs from previous ones, which largely evade traditional analysis.


Dawn Security Group

Dawn Security Lab
Dawn Security Lab mainly focuses on system and iOT security research. The Lab has found more than hundreds of CVEs on Google, Apple, Samsung, etc and members consisting of formal Pwn2Own champions. The Lab's twitter is @dawnseclab.

Friday May 20, 2022 17:30 - 18:30 PDT
Main CanSecWest Ballroom - Sheraton Wall Center 1000 Burrard St, Vancouver, BC V6Z 2R9