Technology
Android C2PA camera applications vulnerable to cryptographic signature forgery, research shows
Security analysis demonstrates that software exploits and hardware fault injection allow attackers to generate forged media provenance data on Android devices.
The short version
- Security researcher David Buchanan demonstrated that C2PA media provenance controls on Android can be bypassed to generate forged cryptographic signatures.
- The vulnerability affects apps relying on Android Key Attestation or Google Play Integrity, including the Pixel Camera app.
- Root access obtained via software exploits or low-cost hardware fault injection allows attackers to instruct hardware-backed keys to sign arbitrary media files.
- Google marked the vulnerability report as 'Won't fix (infeasible)' due to the systemic architecture changes required, but awarded a $7,500 bug bounty.
Key facts
- Security researcher David Buchanan demonstrated that C2PA camera applications on Android relying on Key Attestation or Google Play Integrity are susceptible to signature forgery.[Hacker News]
- Software root exploits, such as CVE-2026-43499 on Google Pixel devices, allow attackers to bypass attestation checks and generate C2PA forgeries without physical hardware modifications.[Hacker News]
- Low-cost hardware fault injection attacks can grant root access to Android devices while keeping the bootloader locked, preventing attestation mechanisms from detecting the compromise.[Hacker News]
- Attackers with root access can command Android's hardware-backed StrongBox to sign arbitrary user-provided media files, satisfying C2PA authenticity checks for forged images and videos.[Hacker News]
- Google closed the security submission regarding Android C2PA with a status of 'Won't fix (infeasible)' while awarding Buchanan a $7,500 bug bounty.[Hacker News]
What remains uncertain
- Reports indicate Apple is developing its own media provenance solution, but no official system or implementation details have been publicly released.[Hacker News]