PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A small bug in the signature verification of AOSP OTA packages

blog.quarkslab.com | research | #android | #vulnerability | #aosp | #ota | #signature-verification | #zip
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab finds a small but critical bug in AOSP's OTA package signature verification — a bypass in RecoverySystem.verifyPackage, which checks the integrity of update ZIP archives.
Published
Collected

Related coverage

research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
research · blog.quarkslab.com
Breaking Secure Boot on the Silicon Labs Gecko platform
Vulnerability research on Silicon Labs' Gecko Bootloader: an OTA parser flaw in the open-source Gecko SDK that breaks Secure Boot and affects connected devices built on the platform.
research · bughunters.google.com
Google's PageBreak Project – Real-World Findings
This post provides a technical deep dive into specific, real-world vulnerabilities discovered by Google's PageBreak scanner
research · eshard.com
Can AI bring Mobile Application Security Analysis in-house?
Can AI bring mobile app security analysis in-house? See how Epoch's time travel traces and an AI agent test an Android app against OWASP MASVS.
research · calif.io
WeWorm
# WeWorm The first zero-click worm to spread through WeChat calls across iOS and Android. Calif Research September 8, 2026 Covered by The New York Times on September 8 and September 11...
research · eshard.com
Introducing Epoch: Time Travel Debugging Built for the Agentic Era
Discover Epoch, esReverse’s new Time Travel Debugging platform for full-system analysis, AI-assisted investigations, and reproducible execution traces across Windows, Linux, Android, and IoT.
Back