A curated, topic-indexed collection of conference talks covering Android exploitation, reverse engineering, and platform security, assembled for authorized professionals building a systematic education path.
| Tool | actuator/Android-Security-Exploits-YouTube-Curriculum — curated topic-organized index of Android security conference talks |
| Category | Educational resource / link curriculum |
| Primary Use | Structured self-study of Android exploitation, reverse-engineering, kernel, and ecosystem security via conference talks |
| Safe Use | Educational and documentary material for authorized security professionals, students, and defenders studying publicly disclosed research |
| Telemetry Note | Purely a static link list on GitHub; using it leaves no trace beyond normal repository traffic, and all content is already-public conference material |
actuator/Android-Security-Exploits-YouTube-Curriculum is not a tool in the executable sense — it contains no code, no installable package, and no license file. What it is instead is a deliberately structured reading list, a curated map of publicly released conference talks spanning roughly a decade of Android security research, organized into fourteen topical sections. For a professional trying to reconstruct how the field evolved from DEF CON 26-era carrier device audits to Black Hat Asia 2026 boot ROM attacks, this kind of index saves dozens of hours of scattered searching. The repository carries around 820 stars and a topic tag list that reads like a conference directory: defcon, blackhat, bsides, ekoparty, nullcon, offensivecon, shmoocon, troopers24, insomnihack, and more.
The organizing principle is what makes this repository valuable rather than just a bookmark dump. The maintainer has grouped talks under headings like Android Exploits & Attacks, Android Permissions & Privileges, Android Webviews & Javascript Interfaces, Android Reverse Engineering & Obfuscation, Android Bluetooth Security, Payment Systems & ATMs, Android Malware & Surveillance, Android Hardware Vectors, Android GPU Attacks, Baseband Attacks, Hard-Coded Credentials & Adjacent Attacks, Android Kernel Exploits, Input Validation & Path Traversal Attacks, and Android Ecosystem & Supply Chain Security. That taxonomy mirrors how the research community itself partitions the attack surface — framework-level logic bugs, memory corruption below the framework, radio and hardware-adjacent layers, and ecosystem-level trust failures — so the curriculum doubles as a conceptual map of the platform.
The first and largest section, Android Exploits & Attacks, is a timeline of the discipline's landmark disclosures. You get Guang Gong's TiYunZong exploit chain from Black Hat USA 2020, still one of the most cited remote-root narratives in modern Android history, sitting alongside recent material like the 39C3 talk on WhatsApp zero-click exploits, Simon Janz's Mobile Hacking Lab Con 2026 presentation on heap exploitation against Scudo, and Xiling Gong's OffensiveCon26 walkthrough of the Qualcomm DSP driver attack path from zero to root. The breadth here means a reader can trace how exploitation shifted from browser-driven chains toward DSP, GPU, and TEE-adjacent surfaces as framework hardening matured.
The Android Permissions & Privileges section captures the long tail of logic-level privilege escalation research that never needs a memory corruption primitive at all. Entries cover LaunchAnyWhere-style intent redirection, PendingIntent misuse in system apps, confused-deputy patterns like the pSlip attack from Shmoocon 2025, (UN)protected Broadcasts in Android 9 & 10, and Ryan Johnson's recurring audits of prepaid carrier devices shipping vulnerable out of the box. For defenders and authorized mobile pentesters, this section is arguably the most operationally relevant, because permission-model confusion bugs remain among the most common findings in real application assessments today.
The Android Webviews & Javascript Interfaces section is small but pointed, tracking a bug class that has haunted the platform for over a decade. It includes the classic Javascriptinterface revisit from Black Hat Asia 2021, file-theft-via-WebView techniques from Shmoocon 2020, the AutoSpill credential-leak research against mobile password managers from Black Hat Europe 2023, and a Mobile Hacking Lab Con 2026 talk on deeplink and URI validation pitfalls. Anyone auditing hybrid apps that embed web content will recognize every one of these failure modes from live engagements.
Reverse engineering gets its own section, and the README signals where the field is moving. Alongside Axelle Apvrille's Nullcon Berlin 2024 analysis of the difficulty of reversing Flutter applications, there is Samuel Hopstock's BSidesMunich 2025 translation of classic mobile app security lessons to the Flutter stack and an Ekoparty 2026 hardware-in-the-loop teardown of a VR headset link. The presence of two Flutter-focused talks out of a handful of entries is a useful signal: cross-platform frameworks are now a first-class target category rather than a curiosity.
The deeper sections — Android Kernel Exploits, Android GPU Attacks, Baseband Attacks, and Android Hardware Vectors — represent the specialist tier of the curriculum. These are the layers where exploitation research increasingly concentrates as application-framework hardening, MTE adoption, and sandboxing improvements close off easier paths; the README's inclusion of Beyond Android MTE: Navigating OEM's Logic Labyrinths from OffensiveCon24 and the TEE-focused Not To Be Trusted talk from 39C3 reflects that shift. Talks like Practical Attacks Against Smartphone Boot ROMs and Breaking the Ethereum Phone extend the trust boundary discussion down to silicon-anchored keys.
There is also an ecosystem-surveillance dimension that makes the list useful to defenders, not just attackers. Sections on Android Malware & Surveillance, Android Ecosystem & Supply Chain Security, and Hard-Coded Credentials include research on preinstalled malware (ADUPS), keyboard-app crypto weaknesses, tracking across apps and web, and forensic-tool countermeasures. Blue-team analysts building detection content or threat models for managed Android fleets will find the disclosed IOCs and behavioral patterns in these talks more directly actionable than the exploit-chain material.
From a documentation-quality standpoint, the README is functional rather than polished: each entry is a linked talk title with conference name and speaker attribution, no abstracts, no difficulty ratings, and no suggested viewing order. The repository carries no LICENSE, no contributing guide, and the language field is empty — expected for a link list, but worth noting if you plan to fork or redistribute. Links point to youtube.com and media.ccc.de media archives, all of which are public conference recordings released by the researchers themselves.
As an educational artifact, this curriculum sits comfortably within an authorized-professional context: every referenced talk is public disclosure of patched or responsibly reported research, intended by its authors for peer education. It is best used as an onboarding syllabus for junior mobile security consultants, a refresher index for senior researchers catching up on adjacent subspecialties, or a source of historical context when writing threat models. Pair it with hands-on practice on owned lab devices and platform bug-tracker archives, and you have a genuinely coherent self-study program for Android security work in 2026.
The main caution is inherent to the format: a static list rots. Several entries already reference talks from 2026 conferences while older links risk drifting as channels reorganize, and there is no visible automation keeping the list validated. Contributors and consumers should verify links before building training material around them, and treat the conference attribution as the durable identifier — the talk title plus venue plus speaker will locate the recording even if a URL dies. That minor fragility aside, actuator has assembled one of the more complete topical maps of Android security research currently available in link-list form.
actuator/Android-Security-Exploits-YouTube-Curriculum.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.