The sub-techniques beta is now live! Read the release blog post for more info.

Exploit OS Vulnerability

A malicious app can exploit unpatched vulnerabilities in the operating system to obtain escalated privileges.

ID: T1404
Tactic Type: Post-Adversary Device Access
Tactic: Privilege Escalation
Platform: Android, iOS
MTC ID: APP-26
Version: 1.0
Created: 25 October 2017
Last Modified: 17 October 2018

Procedure Examples

Name Description
BrainTest

Some original variants of BrainTest had the capability to automatically root some devices, but that behavior was not observed in later samples.[5]

Exodus

Exodus Two attempts to elevate privileges by using a modified version of the DirtyCow exploit. [10]

FinFisher

FinFisher comes packaged with ExynosAbuse, an Android exploit that can gain root privileges.[9]

Gooligan

Gooligan executes Android root exploits.[3]

HummingBad

HummingBad can exploit unfixed vulnerabilities in older Android versions to root victim phones.[8]

Pegasus for Android

Pegasus for Android attempts to exploit well-known Android OS vulnerabilities to escalate privileges.[4]

Pegasus for iOS

Pegasus for iOS exploits iOS vulnerabilities to escalate privileges.[7]

ShiftyBug

ShiftyBug is packed with at least eight publicly available exploits that can perform rooting.[1]

Skygofree

Skygofree has the capability to exploit several known vulnerabilities and escalate privileges.[2]

SpyDealer

SpyDealer uses the commercial rooting app Baidu Easy Root to gain root privilege and maintain persistence on the victim.[6]

Mitigations

Mitigation Description
Application Vetting

Application vetting may be able to identify the presence of exploit code within applications.

Security Updates
Use Recent OS Version

References