3 ms·
I assume that the level that the malware is running at couldn’t simply modify the OTA file and inject itself back in?
by flatiron 4y ago
I assume that the level that the malware is running at couldn’t simply modify the OTA file and inject itself back in?
- saagarjha 4y agoPotentially but then you get into “reflections on trusting trust” type attacks, which are pretty hard to sustain.
- MishaalRahman 4y agoAccording to the OP of the report, the key used to sign an OTA image and the key used to sign system apps are different.
- saagarjha 4y agoI believe the author of this report and the discoverer are different people.
- MishaalRahman 4y agoOh yeah, that's true. Here's who I was citing then: https://twitter.com/maldr0id/status/1598467755887529990 https://twitter.com/maldr0id/status/1598467755887529990
- ShredKazoo 4y agoIf your device is rooted, it seems like maybe the malware could change the key used to verify the OTA update to a key controlled by the malware authors? (I don't know how that key is stored.)
- Sirened 4y agoYes but actually no. While they may be able to install a bogus update, unless they also compromised the keys for verified boot the system won't boot if they change anything interesting as AVB has a hardware root of trust (typically).