38C3 - Ultrawide archaeology on Android native libraries

Title:
38C3 - Ultrawide archaeology on Android native libraries
Description:

A bug in a scraper script led to us downloading every single native library in every single Android app ever published in any market (~8 million apps).
Instead of deleting this massive dataset and starting again, we foolishly decided to run some binary similarity algos to check if libraries and outdated and still vulnerable to old CVEs. No one told us we were opening Pandora's box.
A tragic story of scraping, IP-banning circumvention, love/hate relationships with machine learning, binary similarity party tricks, and an infinite sea of vulnerabilities.

A rumor has been going around: Android developers are slow to update native dependencies, leaving vulnerabilities unpatched.
In this talk we will show how *wrong* this rumor is: Android developers are not slow to patch - they never heard of the word patching.
We conduct a massive study over the every single app ever published on Android (more than 8 million!).
We explore trendy topics like Play Store scraping, Androzoo scraping, Maven repository scraping, the state of the Android ecosystem, binary similarity state-of-the-art methods vs binary similarity pre-historic methods, and the consequences of thinking you know how databases work when you actually don't.

Luca Di Bartolomeo (cyanpencil), Rokhaya Fall

https://events.ccc.de/congress/2024/hub/event/ultrawide-archaeology-on-android-native-libraries/

#38c3 #Security

Licensed to the public under http://creativecommons.org/licenses/by/4.0

more » « less
Video Language:
English
Duration:
39:30
http://www.youtube.com/watch?v=Qhqh2yUpD3s
Format: Youtube
Primary
Original
Added   by C3Subtitles
Format: Youtube
Primary
Original
This video is part of Amara Public.

Subtitles download

Incomplete subtitles (1)