4 ms·
According to the OP of the report, the key used to sign an OTA image and the key used to sign system apps are different.
by MishaalRahman 4y ago
According to the OP of the report, the key used to sign an OTA image and the key used to sign system apps are different.
- saagarjha 4y agoI believe the author of this report and the discoverer are different people.
- MishaalRahman 4y agoOh yeah, that's true. Here's who I was citing then: https://twitter.com/maldr0id/status/1598467755887529990 https://twitter.com/maldr0id/status/1598467755887529990
- ShredKazoo 4y agoIf your device is rooted, it seems like maybe the malware could change the key used to verify the OTA update to a key controlled by the malware authors? (I don't know how that key is stored.)
- Sirened 4y agoYes but actually no. While they may be able to install a bogus update, unless they also compromised the keys for verified boot the system won't boot if they change anything interesting as AVB has a hardware root of trust (typically).