Android bootable recovery mode is a self-contained alternative boot mode that loads a tiny Linux environment onto a mobile device. While most stock devices are shipped with recoveries that are fairly limited in nature, their use can be greatly extended with a little bit of effort. In this presentation, I will show you how to build your own custom recovery for your Android device. This can be used towards a number of interesting security related goals such as: penetration testing, forensics, data acquisition, bypassing security controls, modifying software, Android development and in some cases provides a direct exploitation route into a device. Using a variety of commonly available tools, attendees will learn how to deconstruct and inspect a number of different boot and recovery software implementations and rapidly begin compiling their own custom tools and discovering vulnerabilities in their device's bootable firmware in the process.

Bio: Drew is a security consultant for Matasano Security with a focus in mobile application testing and research. Before moving into security, Drew worked with large scale UNIX environments for a variety of companies. In addition, Drew is a member of the CyanogenMod (open source side) team and has ported custom Android bootable firmware to dozens of devices. Besides facilitating the installation of custom code such as CyanogenMod, Drew likes working on unloved, problem devices with strange or nonstandard setups. Drew also writes and maintains the CyanogenMod wiki which helps users install CM on their stock Android devices using a variety of different exploits and techniques.

Back to Circle City Con 2015 Videos list