How Android Security Works (in a nutshell)

[@nessunolinux]

POV: You're waiting for the bus and this girl walks up to and starts lecturing you on cyber security

[@tedlasso2887]

Lol😂

[@ozfresh]

one can only dream

[@tigerscott2966]

What security ? every bit of data goes thru them. that's like having Windows and Apple as your dinner guests. You know you are going to get robbed, so you leave your money in the bank.

[@vishmonster]

God I wish

[@ratvomit874]

"It is recommended to *fsck* at least once a week"

[@ionbg7]

Forgot android is essentially linux

[@misarthim6538]

iOS is, to an extent, essentially FreeBSD.

[@JBroMCMXCI]

🤓

[@RogueParatha]

With a pre-installed java runtime, yeah.

[@MinecraftMasterNo1]

@@RogueParatha No one except old maintainers actually dev in Java anymore. It's all Kotlin nowadays.

[@Sharp931]

​@@misarthim6538Apples and oranges 😂

[@RedHair651]

I didn't know I needed quality CompSci content delivered with a handful of "👉👈🥺" energy

[@AlexanderEndless]

I'm not sure what to do, this is such great information, and that voice is so cute.

[@Boxcow45]

T-thanks but can I have my phone back

[@RogueParatha]

To add an additional layer of security, she will now be keeping your phone safely with her.

[@Boxcow45]

@@RogueParatha 😞

[@parkourninja21]

LOL

[@mankaner]

haha yeah, stop talking about my phone in that manner.

[@Daniel15au]

Android also runs each app as a different user which helps with isolation (somewhat).

[@johndawson6057]

How does that work?

[@Daniel15au]

@@johndawson6057 It's similar to how you'd usually configure daemons (server processes) on a Linux server. There's a separate Unix user per app. This is how Android apps can have private files that other apps can't access (it's just chmod 0700), and how VPN apps can have split tunneling where only certain apps usr the VPN (Linux lets you namespace network stuff per user).

[@waldolemmer]

​@@johndawson6057Not sure, but you can see what it looks like by installing a terminal emulator and running `whoami`. It spits out 'u0_a314' on my phone and 'u0_a438' on another. It'll probably also give different output for other terminal emulator apps. I believe 0 represents the default Android user (Android lets you have different users, which is distinct from the concept of Linux users). The default Android user's files are located at /storage/emulated/0/.

[@hackbod]

User-based (uid) isolation is actually Android's core security mechanism. Each app/sandbox is run in its own user -- if you think about it, Linux provides very good multi-user isolation, so this gets to leverage all of that. SELinux is an additional layer of isolation on top of uids, providing some additional isolation, but more importantly defense-in-depth so that if a security bug is found in the uid-based isolation often SELinux will still prevent that from becoming exploitable.

[@tommyhuffman7499]

Fascinating video, and perfect timing as I was researching Android earlier today.

[@joserobles11]

Coincidence? You should thank the wonders of not having privacy

[@solidwire]

@@joserobles11 I'm sure it's just me but I fail to see the parallels between surrendering privacy and research?

[@gerakore8948]

this is what i like about android. on other systems software has free reign over your devices. there should be limits on how much access is granted.

[@g00st62]

It's all fun until you actually want to use a feature that the OEM doesn't want you to have access to. I hate how incredibly locked down Android is on most devicesis.

[@gerakore8948]

@@g00st62 i miss the days where you could read the ram of whatever app is running.

[@jonnanieminen8848]

not tue. Ever heard about iOS? It's even more secure than Android

[@tear728]

Her voice makes always my ears tickle 😂

[@Orincaby]

what the actual fuck 💀

[@pixselious]

ASMR moment

[@psi4j]

She’s freakin adorable. And smart.

[@Cineenvenordquist]

That's the rooting your subconscious tonality preference robot.

[@tauser2]

Every app should have a containerized storage space, I hate giving access to all my files when ask permission to store some data.

[@sujalmane6813]

Sandbox feature is there in Android which allows apps to only access the files which are created by that app.. and the files which you will share on that app which has access to your files

[@omaryorke]

Android 14 solves this issue. Not entirely because whatsapp still has access to all files

[@d_the_great]

Typically, an app can only store data in its own specific folder in Internal Storage/Android/data, but you have to give it permission to access files anywhere else. If you mean giving it access to just one folder using file explorer, which opens anyway when the app asks for permission, I agree. But if it was restricted to just its own folder like it works with Android/data, it would be annoying to use things like emulators that need to access files such as ROMs or other folders on your device.

[@MrMybiglongbananna]

thats why i love android ... i know apple uses encryption on passward to open so its safe but that just makes it a paper weight when its out of date or sell... i like the android approach and open source tech...

[@edeshkumar9686]

She flirts with us through screen

[@woutverjans2928]

Yeah, once had to make a simple app but i hated programming and in specific the little things i had to do to make it work. Not only did you need to connect and use the camera but you also had to edit the manifest file and only then could your app ask acces for something. I hated it

[@Cineenvenordquist]

I mean, welcome to OpenBSD and promises too, but ok having to change the manifest file is another step.

[@WolfiiDog13]

How do you explain it so well, yet it fits on a short? I'd take so long...

[@SalivatingSteve]

It’s on the Android developer website.

[@jdhan3349]

This just increased my trust in my device now

[@mykedev4377]

Great video, how does the KeyStore and Secure Element (if present) fits in all this?

[@Anita95_original]

Love the pony tails. BTW, I would like apps in their own directory, sandboxed, and access to other directories given ONLY manually.

[@joshua43214]

I forget the name of it, but there is an Android distro that does exactly this. Only runs on the Pixel tho, which is a deal breaker for me

[@0xfolling]

Perhaps GrapheneOS' appprivate storage?

[@pizzadesushi0000]

all of that and google still knows every thought i have

[@solidwire]

Oh it's secure alright... So secure I still can't find the rotary dial to make a phone call... Seriously... Thank you as I Enjoy these snippets of either base info to a thorough yet quick overview... These have helped solve an issue or two in which I was making the problem more complex than necessary... Nice work ! ! I can't tell if you're sharing knowledge based on projects or is this part of your study method for classes? Be well ! !

[@waldolemmer]

She's a KZbinr. She makes money by making videos.

[@criticaltinkering]

I don't wear contacts, so I'm safe.🤓

[@ZackyJamel]

Hi @Lauriewired, I was following your frida tutorial, but I can't run fridaserver bcz it saying permission denied (Selinux).

[@catmage]

I remember reading somewhere that rooting your device gives all apps root access. Do you know if this is true?

[@LifeSkeptic]

No, you have to grant root access to those apps using the root manager. Although, I am not sure but if your root manager is somehow corrupted through malware or the source is sus then some apps may be given root access without you knowing, never seen that happen though

[@WistrelChianti]

Liking for the info but seriously still hate how I can't be effing root on my own device without employing the work of exploits to gain it

[@Vancer876]

Great video

[@LandonMusic-mr2tn]

I didn’t know that android runs off of SElinux I thought it just ran on regular Linux. That’s actually pretty cool.

[@DavidHelloWorld]

Would love to know how Android’s security compare’s to iOS, and who leads that effort

[@blu3h4t]

selinux is military grade but unix which ios (kinda) is build on is also military grade :D

[@notafbihoneypot8487]

​@@blu3h4t, that means nothing.

[@notafbihoneypot8487]

To answer, this is somewhat a complex issue, its "loosely based" on the Unix , Because android can be put on anything, its hard to pin point because depends on the vendor and streamline updates, Stock Iphone can be far more secure then Stock android, (depends on the vendor) on the android side too. GOS has a slightly higher stock android security "stock" experience.

[@blu3h4t]

@@notafbihoneypot8487 i bet m$ would beg to differ :D

[@LongerThanAverageUsername]

@@notafbihoneypot8487not a very military grade response of you. SMH

[@paxcoder]

Is this that "Anime" I've heard about? It's super realistic. P.S. I do believe you're one smart and capable cookie, don't get me wrong sis.

[@riyadm2006]

U feel like AI

[@hansisbrucker813]

TIL Android uses SELinux. Makes sense in hindsight 🤔

[@Tok3r213]

The virtual machine Android

[@erintyres3609]

Everything that she says is true, but your calls, movements, and online activities are still closely tracked on all smart phones.

[@Cineenvenordquist]

Root while you may? To that effect, are Lineage OS (open source android something something) builds not sourcecode accompanied or indeed mods for people who need press and other protections not offered as a sidecar?

[@erintyres3609]

@@Cineenvenordquist Lineage OS or Graphene OS improve your device's security to some extent, but I believe that the user's calls and movements can still be tracked.

[@claer000]

TOUCHING GRASS MENTIONNED

[@Blklts1]

But still shit like Pegasus exists Security my ass.

[@thesickestnoodle-nq3wn]

pegasus is iOS malware silly (and incredibly more complicated than your average malware since it's state sponsored...)

[@Blklts1]

@@thesickestnoodle-nq3wn My point still stands. iOS supposed to be the best out there innit?

[@jyothishkumar3098]

Pegasus works because the modem isn't isolated from the SoC and it uses nonfree firmware. So it can directly access the CPU and the kernel wouldn't know it. The only solution is to use open hardware devices, or if you can't get FCC to allow open radio firmware, at least using a phone with an isolated modem. But the latest such popular phone I know of is Samsung Galaxy Note 2. I guess the Purism Librem 5 also has it, which would make it the most advanced. Also, Pinephone and Pinephone Pro have free firmware replacement, which cannot be legally shipped due to FCC regulations, which will also be secure.

[@jyothishkumar3098]

​@@Blklts1 iOS is supposed to be the worst lol.. it depends on whether you trust cryptographic science or Apple's marketing claims 😂

[@thesickestnoodle-nq3wn]

@@jyothishkumar3098 lol this is a copypasta wtf are you talking about nothing you say here is even remotely relevant to pegasus...

[@kxpes]

Android is safe for google, not for it's user

[@ahmedamr1124]

Can you back road map for malware analysis

[@yascilisaowsyj8636]

Greetings, fellow gentlemen

[@LeethLee1]

hello sir

[@Sleep4Week]

Do they still use toybox as the bootloader?

[@naveenrawat1549]

Ahmm!!! Agian I forgot to listen can you repeat that 👀👀

[@TheRealUsername]

😒

[@maz5232]

Hi Please teach us how can use frida Thanks

[@mr.shredder5430]

so thats why we cant we c++ directly on android studio

[@deletevil]

This is only valid for non-chinese phones.

[@nireshmaharaj2682]

Apps are not safe. Don't believe that for a minute.

[@iecasper]

Normally...😢

[@wakeupNeo_]

yes please

[@amirarshiamirzaei710]

wow a security analyst who touch grass WTF the world has come to and end ! (joke BTW)

[@dao_jones]

Wrong, it works like this: "Help! There's not enough RAM to perform virtualization inside this nutshell!"

[@Cineenvenordquist]

Try a flagship or even just a new tcl or OnePlus phone. 32GB oughtta be 3 VM?

[@electromatic138]

Simps in the chat boys

[@coreym162]

Learn what that "Acronym" means, please!

[@nuxbot919]

Yes mommy

[@erict.35]

More like daddy. Can’t you hear the postproduction higher pitched voice tuning? Artificial cuteness.

[@WillJackDo]

OMG IRL ANIME GIRL!!!

[@g04tn4d0]

I like her voice. 🐐😍🎉

[@xila8861]

oh, she is real. very cool content, keep it up.

[@nicholaszustak6299]

Sounds very similar to iOS

[@jyothishkumar3098]

But no one knows how iOS works under the hood, except Apple

[@mcorbin9474]

NERDS!

[@InkaHacker]

I'm on love 🥺🌹

[@hmimzomatrix]

su -c setenforce 0

[@bihamdabih]

Cool

[@and0x00]

ASMR ...

[@osark2487]

She may just read lorem ipsum and I would watch anyways. Thats the only tech channel I subscribed, that I care not for the tech

[@knewdist]

domo arigato mr. roboto gozaimasu 😶‍🌫️

[@virno69420]

SELinux = NSA's backdoor

[@RogueParatha]

Care to elaborate how a process isolation system is a backdoor?

[@virno69420]

@@RogueParatha Nice try fed, I'm a good citizen

[@henleyn5046]

How

[@thesickestnoodle-nq3wn]

@@RogueParatha developed by the NSA, for the NSA. Checkmate liberal. *starts twerking*

[@maracaman1]

​@virno69420 schizophrenic

[@Abandex369]

wife

[@Sharp931]

M'lady! 😻

[@AGGPEE]

UwU

[@alexyo2440]

If it wasn't for the head bobs you'd think this was AI generated

[@damionmccoy9966]

You make it sound so secure when reality is it's far from it.

[@henleyn5046]

It would be useful to explain why

[@popcat2309]

@@henleyn5046 i doubt that he has any explanation. he heard it from software and dumped it here to sound cool

[@31redorange08]

​@@henleyn5046 We all know he can't elaborate.

[@stephenjacks8196]

Android has security?

[@FMTC11]

She talks like Poppy. Also sounds like an AI voice.

[@notaras1985]

You are so bitter

[@Cineenvenordquist]

Er, linkify what you mean, but it's more interesting if you say what menaces etc. in her audio spectrograph.

[@BltEnthusiast]

Why this sound like chat gpt

[@JBroMCMXCI]

First pin me 🥺

[@WobblyPlays]

NAAAAHHH BRU AINT NOBODY GONNA PIN SOMEONE AS ANNOYING AS YOU

[@isaachernandez5867]

Would be better if you talk normally.

[@jyothishkumar3098]

Would be better if you behave civilized

[@isaachernandez5867]

​@@jyothishkumar3098 How so?

[@shiiswii4136]

​@@isaachernandez5867She is speaking normally