MAJOR EXPLOIT: This GIF can Backdoor any Android Phone (sort of)

Показать описание

In this video, we take a deep dive into the inner mechanics of a double free vulnerability within Android OS, allowing attackers to gain complete access to any Android mobile phone with an RCE (remote code execution). This vulnerability was exploited by creating a custom GIF file and sending it to a user in WhatsApp. Whether you're a pen tester, security researcher, or cyber security expert, having a solid foundation in low level languages, especially C, is critical.

0:00 - Overview
0:35 - GIFs
1:02- GIFs within Android
2:10- Memory / Pointers
3:35 - Double Free
6:02 - WhatsApp Payload
8:24 - RCE

Original report by security researcher Awakened

Double free within android-gif-drawable

MUSIC CREDITS:
LEMMiNO - Cipher
CC BY-SA 4.0

LEMMiNO - Nocturnal
CC BY-SA 4.0

#programming #software #softwareengineering #computerscience #code #programminglanguage #softwaredevelopment #hacking #hack #cybersecurity #exploit #tracking #softwareengineer #vulnerability #pentesting #privacy #spyware #malware #cyber #cyberattack #bugbounties #ethicalhacking #mobile #android #doublefree #malloc #realloc #GIF #mobilesecurity #lowlevelsecurity #zeroday #zero-day #cybersecurityexplained #bugbounty #compiler #memorymanagement #kernel #operatingsystems #OS

Рекомендации по теме

Комментарии

Kinda cool, the principles of these kinds of low level exploits are not so different from how speedrunners achieve arbitrary code execution in old games, mess around with pointers until they point to the memory address of the code you want to run next, and they do this by exploiting glitches during gameplay

crism

Genuinely, what a great explanation of the double free vulnerability! Really love the detail and this can be very useful for anyone getting into binary exploitation techniques.
For me this really solidified the basics I saw here and there, with a nice practical example

JRAN

as soon as i realized the gif struct had a function pointer it was over

memes_gbc

One of the best explanations ever of an exploit that goes into technical detail!

J_i_m_

Amazing explanation! I like how you managed to dive pretty deep without making the video super long

quazar-omega

Good video.
the title however is misleading, it's not ANY android phone it's android phones that already have a malicious application installed and whatsapp, additionally the title implies that the exploit can be used right now, even though it was patched years ago by both whatsapp and android

cheatertim

"for whatever reason they're parsed twice" sounds like intentional backdoor to me.

josephs

I went to college in 1990, and they were still teaching C for first year programming. Java was still new to the game, so you had a choice of Pascal or C. I remember the professor told us that after the 3rd week we can expect half the class to drop. The 3rd week is when he introduced pointers. He wasn't wrong. This is a great video that helps illustrate the concept behind pointers. I think part of the problem was the professor, but I wasn't going to say anything. I taught myself assembler when I was 14, so pointers to me were already natural and I had no issue understand them. Half the class struggled immensely and wound up dropping before the first mid-term.

BitwiseMobile

Great comparison between these two channels, got me thinking more about my upcoming videos.
And I have asked my self the question you end on I just need to make it more clear who I'm targeting in my titles

TheDanishMaleNurse

What a GOAT!!! The way you edit the videos to match as you explain is amazing, specially the “under the hood” explanations! Legend in the making

TheControlMastr

How the researcher discovered gifs were rendered twice in whatsapp is very interesting. I mean i know some people who does reversing on major android apps or iphone app ipa files but i dont know they do the research with that depth of knowlege.

_

Fantastic video Daniel, I cant wait for the next video!

maternalpick

Awesome video🔥 RCE is so cool, tnx for explaining everything!!

hengolubenko

epic video, didn’t understand it much but it was cool, maybe even better than your previous one

springier

Well at the last second you took away its powers by explaining that the user would have needed to basically download a virus first. But I could see this working for a malicious company that creates popular apps with the goal being to use the app as the “virus” agent to get that local address saved and get the user’s phone number through a sign up or something. And with the local address and the phone number, sending them a gif on WhatsApp (if they have WhatsApp) would work. Seems like it would work best if you had a huge database of potential victims. Thx for explaining this stuff bro.

edit: I was wrong about how this works

HowsDaJello