cyber.hendryadrian.com
YouTube · LiveOverflow

LiveOverflow Demonstrates Android Security Training and Fault Injection at DEF CON 2024

· 26:35 · Watch on YouTube ↗

Summary

At DEF CON 2024, LiveOverflow presented Hextree’s Android security courses and a hands-on fault-injection lab. The video describes training on finding Android app bugs, including a ContentProvider vulnerability Fabian says he found in the Flipper zero app.

Key points

  • Fabian says Google commissioned Hextree to create official Android application-security courses.
  • At a Google Bug Hunter event, the workshop focused on finding vulnerabilities inside Android applications, rather than using apps mainly to discover hidden web APIs.
  • Fabian planned to demonstrate a ContentProvider vulnerability he says he found in the Flipper zero Android app.
  • The DEF CON lab used the Faultier board to briefly drop voltage and glitch a Glitch Tag target based on the Apple AirTag chip.
  • The team described a microcontroller bug-bounty challenge with Raspberry Pi and thanked the company for working with them on the RP2350 chip.
  • Based on Hextree statistics, Fabian estimated that about 150 people were introduced to fault injection and glitching.

Article Details

Topics
  • [00:15] Google-commissioned Android security courses and Hextree’s DEF CON plans
  • [01:30] Planned microcontroller bug-bounty challenge with Raspberry Pi
  • [04:46] Android application-security and reverse-engineering talk for students
  • [12:30] Android bug-hunting workshop and the Flipper zero ContentProvider vulnerability example
  • [16:26] Fault-injection lab using the Faultier board and Glitch Tag target
  • [21:58] Estimated number of people introduced to fault injection and glitching
  • [25:48] Raspberry Pi collaboration on the RP2350 chip and security challenge

People

FabianFabian identifies himself as a security consultant who audits code and reports vulnerabilities; he led Android application-security and reverse-engineering training.

Vendors

GoogleGoogle commissioned official Android application-security courses from Fabian and hosted the Bug Hunter event where he taught a workshop.Raspberry PiRaspberry Pi collaborated with Hextree on a microcontroller security challenge and the RP2350 chip.

Products

AndroidAndroid application security, reverse engineering, and vulnerability discovery are the focus of Hextree courses and the Google Bug Hunter workshop.Flipper zeroFabian said his Android security course uses a ContentProvider vulnerability he found in the Flipper zero Android app as an example.

Tools

FaultierThe hardware attack board used in Hextree’s lab; it performs voltage glitching by briefly dropping voltage.

Related Articles