#Android malware speech recorder android#

In reality, threat-actors that already have kernel code execution capabilities can replace the “entitlements” of mediaserverd to perform such injection. Lldb does not rely on task-port, instead it calls the kernel for code-injection.

#Android malware speech recorder android#

To inject into mediaserverd, we used lldb. The app, titled iRecorder Screen Recorder, started life on Google Play in September 2021 as a benign app that allowed users to record the screens of their Android devices, ESET researcher Lukas. We need to find a way to make mediaserverd do nothing when it detects that the process is running in the background.įollowing a brief research we found that it is possible to prevent mediaserverd from revoking camera access by hooking into an Objective-C method -, so no code overwriting is required. When a process switches to the background, mediaserverd will get notified and revoke camera access for that particular process. It’s not common: these signs are telling us that mediaserverd is in-charge of something important. mediaserverd also gets killed by the system frequently when it’s not responding, even for a short time. Noteworthy, mediaserverd is equipped with a special entitlement (get-task-allow) to prevent code injection.Īs a result of “get-task-allow” entitlement, dynamic debugger relies on obtaining task ports like cycript, frida do not work on the mediaserverd daemon. It also terminates the camera access when it detects an application is no longer running in the foreground.

It is an extra layer of security after tccd. Mediaserverd is a daemon that monitors media capture sessions. Processes that want to access the camera must be approved by tccd as well as mediaserverd.

Accessing Camera in the Background by Patching ‘mediaserverd’