Keenadu Android firmware-level backdoor embedded in libandro...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://securelist.com/keenadu-android-backdoor/118913/
• Blog Title: Keenadu: Android firmware-level backdoor embedded in libandroid_runtime.so
• Suggested Section: Mobile Pentesting -> Android Applications Pentesting (new page: "Firmware-level backdoors / Zygote-wide injection via libandroid_runtime.so"; also cross-link from Reversing or Android OS internals if present)

🎯 Content Summary

Title/Scope
Kaspersky analyzes Keenadu, an Android firmware-level backdoor inserted during the firmware build phase (supply-chain compromise). The key technical property is that the implant is embedded into a core OS library, /system/lib/libandroid_runtime.so and /system/lib64/libandroid_runtime.so, causing malicious code to be loaded into the address space of every app process at runtime (via Zygote), effectively nullifying Androi...

🔧 Technical Details

Backdooring a core Android runtime library function that is universally reachable (e.g., patching android.util.Log.println_native inside libandroid_runtime.so) provides reliable code execution in every app process forked from Zygote. A native stub can decrypt an embedded second stage (e.g., RC4), persist it at a plausible dalvik-cache path, and execute it with DexClassLoader (Java entrypoint like com.ak.test.Main), bypassing app sandbox boundaries by running inside each target app context.

Implementing a malicious system-service model by running a server component in system_server (AKServer) and exposing binder interfaces to per-app clients (AKClient) via protected broadcasts (e.g., com.action.SystemOptimizeService, com.action.SystemProtectService) enables centralized command and control. Clients can attach via binder and pass an IPC wrapper so the server can load arbitrary DEX into selected target apps, while a second interface allows privileged operations suc...

🤖 Agent Actions

Updated HackTricks with a new Android firmware backdoor page detailing Zygote-wide execution via patched libandroid_runtime.so, RC4-to-DexClassLoader dropper flow, binder-based AKClient/AKServer architecture, C2 crypto/activation gating, supply-chain persistence, and forensic indicators. Linked the new page from the Android app pentesting case studies section.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://securelist.com/keenadu-android-backdoor/118913/

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting -> Android Applications Pentesting (new page: "Firmware-level backdoors / Zygote-wide injection via libandroid_runtime.so"; also cross-link from Reversing or Android OS internals if present)".

Repository Maintenance:

• MD Files Formatting: 949 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0