Hacker News Reader

I assume that the level that the malware is running at couldn’t simply modify the OTA file and inject itself back in?

Potentially but then you get into “reflections on trusting trust” type attacks, which are pretty hard to sustain.

According to the OP of the report, the key used to sign an OTA image and the key used to sign system apps are different.

I believe the author of this report and the discoverer are different people.

Oh yeah, that's true. Here's who I was citing then: https://twitter.com/maldr0id/status/1598467755887529990

If your device is rooted, it seems like maybe the malware could change the key used to verify the OTA update to a key controlled by the malware authors? (I don't know how that key is stored.)

Yes but actually no. While they may be able to install a bogus update, unless they also compromised the keys for verified boot the system won't boot if they change anything interesting as AVB has a hardware root of trust (typically).

Reply on news.ycombinator.com