4 ms·

No they always check the signature before applying the patch.

• Domenic_S 15y ago
  Check it against what? A pwned digest?
  • shoota 15y ago
    Unless you're rooted the updates are checked with the public key to make sure they are signed with the correct private key. Unless Google lost their set of private keys it wouldn't be possible to modify the update. It's entirely possible there are other exploits but a modified update.zip is not a likely vector.
    • avree 15y ago
      I'd be willing to bet that 90% of people at Defcon with Androids had them rooted. Many were probably running custom ROMs.
      • shoota 15y ago
        Then you'd be even more suspicious if a carrier OTA popped up on your phone.