LANDFALL New Commercial-Grade Android Spyware in Exploit Cha...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://unit42.paloaltonetworks.com/landfall-is-new-commercial-grade-android-spyware/
• Blog Title: LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices
• Suggested Section: Generic Methodologies & Resources > Basic Forensic Methodology > Specific Software/File-Type Tricks > Structural File Format Exploit Detection (add DNG/TIFF parser exploitation)

🎯 Content Summary

What was uncovered
Unit 42 analyzed a commercial‑grade Android spyware family dubbed LANDFALL that targets Samsung Galaxy devices. Delivery leveraged malformed DNG images (TIFF‑based) that exploit Samsung’s image parsing zero‑day CVE‑2025‑21042 (vendor SVE‑2024‑1969). The DNGs carry an embedded ZIP archive appended at EOF; upon successful exploitation in libimagecodec.quram.so, shared objects from the ZIP are extracted and executed, staging the LANDFALL framework. Activit...

🔧 Technical Details

DNG parser RCE via appended ZIP payloads: Craft a DNG (TIFF‑based) with an embedded ZIP archive at EOF. On vulnerable parsers (e.g., Samsung libimagecodec.quram.so, CVE‑2025‑21042), malformed DNG parsing leads to code execution, allowing extraction and execution of bundled .so payloads. Messaging apps that auto‑process media previews can yield zero‑click infection when chained with a content‑fetch primitive (e.g., WhatsApp CVE‑2025‑55177 on Apple platforms).

Dynamic SELinux policy expansion for post‑exploit privilege widening: Run a dedicated module (l.so) that implements a generic SELinux policy engine. Use sepolicy_from_data/sepolicy_add_statement/sepolicy_to_buffer to inject permissive rules in memory, expanding domains/permissions to enable stealthy persistence, broader IPC/file/service access, and resilient collection without dropping static policy blobs.

Hardene...

🤖 Agent Actions

I analyzed the blog and HackTricks repo, and added the new technical content where it best fits: the existing Structural File‑Format Exploit Detection page under Generic Methodologies & Resources > Basic Forensic Methodology > Specific Software/File-Type Tricks.

What I updated:

• Extended the structural detection coverage for DNG/TIFF by adding a new subsection focused on the Samsung DNG parser exploitation path used by LANDFALL (CVE‑2025‑21042), specifically detecting DNGs with appended ZIP payloads at EOF.
• Included structural signals, concise pseudo‑logic suitable for implementation, and practical DFIR triage commands to identify and carve embedded ZIPs, verify offsets with TIFF metadata, and quickly analyze the carved archive.
• Noted the zero‑click risk when chained with content‑fetch primitives and aligned the content with existing DNG coverage (Apple CVE‑2025‑43300) already on the page.
• Added the Unit 42 blog URL to the References section.

Files modified:

• src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/structural-file-format-exploit-detection.md

Changes summary:

• Added section: “DNG/TIFF – Samsung libimagecodec.quram.so (CVE‑2025‑21042) + Appended ZIP payload (LANDFALL)”
  • Structural signals: TIFF/DNG magic with JPEG-like filename, ZIP magic near EOF not referenced by IFDs, large trailing data beyond last IFD data region.
  • Pseudo-logic for detecting appended ZIP with a conservative gap from the end of TIFF data.
  • Practical triage steps using file/exiftool/tiffdump/grep/dd/zipdetails/unzip/binwalk.
  • Context: used in the wild to stage native modules post-parser RCE; zero-click risk.
• Extended the References with the Unit 42 blog link.

No new files were created; the content integrates into the existing structural detection methodology, keeping it concise and highly technical.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 907
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://unit42.paloaltonetworks.com/landfall-is-new-commercial-grade-android-spyware/

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources > Basic Forensic Methodology > Specific Software/File-Type Tricks > Structural File Format Exploit Detection (add DNG/TIFF parser exploitation)".

Repository Maintenance:

• MD Files Formatting: 907 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0