# Android-Security-Exploits-YouTube-Curriculum: a reading list of talks > This repository is not a tool but a single README that curates modern Android security and reverse engineering conference talks, grouped into fourteen topics from boot ROM attacks to kernel exploits and supply chain risk. It is a study index rather than a framework, its content lives on YouTube rather than in the repository, and the licence is not stated. **actuator/Android-Security-Exploits-YouTube-Curriculum** — 🔓A Curated List Of Modern Android Exploitation Conference Talks - Repository: https://github.com/actuator/Android-Security-Exploits-YouTube-Curriculum - Website: http://Tenodera.com - Stars: 813 · Forks: 68 - Language: Unknown - License: not declared - Published: 2026-10-20 · Updated: 2026-10-20 · Language: en - Canonical page: https://hysenlabs.com/projects/actuator-android-security-exploits-youtube-curriculum ## One README, no code, and a hundred video links The repository contains exactly one file. The top level entries list is README.md and nothing else, and the project description is A Curated List Of Modern Android Exploitation Conference Talks. The primary language is recorded as unknown, which is the honest entry for a document repository, and the licence is also recorded as unknown. So what you are looking at is a link index, and the value of an index is entirely in its organisation. The README opens with a table of contents that names fourteen subject areas, and the list is arranged so that each is a different layer of the stack or a different attack surface: ```text 1. [Android Exploits & Attacks](#android-exploits--attacks) 2. [Android Permissions & Privileges](#android-permissions--privileges) 3. [Android Webviews & Javascript Interfaces](#android-webviews--javascript-interfaces) 4. [Android Reverse Engineering & Obfuscation](#android-reverse-engineering--obfuscation) 5. [Android Bluetooth Security](#android-bluetooth-security) 6. [Payment Systems & ATMs](#payment-systems--atms) 7. [Android Malware & Surveillance](#android-malware--surveillance) 8. [Android Hardware Vectors](#android-hardware-vectors) 9. [Android GPU Attacks](#android-gpu-attacks) 10. [Baseband Attacks](#baseband-attacks) 11. [Hard-Coded Credentials & Adjacent Attacks](#hard-coded-credentials--adjacent-attacks) 12. [Android Kernel Exploits](#android-kernel-exploits) 13. [Input Validation & Path Traversal Attacks](#input-validation--path-traversal-attacks) 14. [Android Ecosystem & Supply Chain Security](#android-ecosystem--supply-chain-security) ``` The homepage given for the project is Tenodera.com, and the topic tags describe the intended audience and the scope, listing android, exploit, hacking, offensivecon, blackhat, defcon, ekoparty, nullcon, bsides, cyberwarcon, insomnihack, owasp, strange-loop-conference, shmoocon, troopers24, recon, reverse-engineering and security. The conference names in the tags are effectively a list of the venues whose talks are collected here, which tells you the curation is drawn from public conference talks rather than from vendor training. For someone learning Android security, this is a different artefact from a wiki or a book. A book is linear and dated. A talk list is current, it is primary source content, and it is organised by the thing you are actually trying to understand. ## The entry format is title, venue and speakers Every entry in the visible portion of the list follows the same shape, and the shape carries the metadata you would otherwise have to look up. A typical entry is a link with the talk title in bold, followed by an indented line giving the conference and the speakers. For instance, the first entry under Android Exploits and Attacks is Subverting Screen Trust via State Disruption and ONE-WAY Flooding, credited to Black Hat Asia 2026 by WeiMin Cheng, Zhihan Lin, Chengdu Royal, Sheng Cao, Songzhou Shi, LSPosed Team and others. The next is Practical Attacks Against Smartphone Boot ROMs, Black Hat Asia 2026 by Christopher Wade, then From Zero To Root: Attacking Qualcomm DSP Driver at OffensiveCon26 by Xiling Gong, and Exploiting Android Apps with Counterfeit Art at OffensiveCon26 by Philipp Mao and Rokhaya Fall. Two things are worth noting about that format. The speaker names are preserved, which matters because in this field a name carries a lot of information about who to follow. And the venue is given with a year, so a talk from Black Hat Asia 2026 and one from Black Hat Asia 2024 are not conflated even when the titles look similar. The venues in the visible list span the security conference circuit. Black Hat Asia appears repeatedly across 2024, 2025 and 2026, alongside Black Hat USA 2023, 2024 and 2025, DEFCON 32 and DEFCON 33, the 39th Chaos Communication Congress, OffensiveCon24 and OffensiveCon25, OffensiveCon26, Ekoparty 2025, Nullcon Goa 2023, USENIX Security 2025, SecTor 2025, BSidesLV 2025, Mobile Hacking Lab Con 2026, and the OWASP 2023 Global AppSec DC. That spread is a good proxy for the current shape of the field. The academic venues supply the peer reviewed depth, the commercial conferences supply the vendor and hardware research, and the hacker congresses supply talks that have not been through a submission process. ## What the topics reveal about current Android research Reading the fourteen headings as a map of the field is more instructive than reading any individual talk title. Several headings are about the layers below the application framework. Boot ROM attacks, baseband attacks, GPU attacks and kernel exploits are all about code that runs with more privilege than any app, and each of them is a separate section, which tells you these are treated as distinct research communities rather than one topic. The baseband section in particular reflects a hardware surface that is invisible to app level testing. Then there is the application and web content layer. Permissions and privileges, webviews and JavaScript interfaces, and input validation with path traversal, are the surfaces where a developer actually has influence, and they are the parts of the list most directly actionable for an application security engineer. The webview and JavaScript interface section reflects an attack class that has become standard in mobile assessments, since a native app that renders remote HTML through a JavaScript bridge inherits the browser's parsing quirks and the app's privileges at once. Reverse engineering and obfuscation sits in the middle, and it is the enabling skill for everything else. Without it, the other talks are unreadable, which is why a curriculum that includes it is coherent rather than a random collection. The remaining headings cover the ecosystem around the device. Bluetooth security, payment systems and ATMs, malware and surveillance, hardware vectors, hard coded credentials, and the final section on ecosystem and supply chain security. Supply chain is the last entry, which is an editorial position as much as a subject: if you can get code execution through the supply chain you never need the exploit. The visible list also shows the current emphasis in the entries. Android TEE research, the age of zygote injection, boot ROM attacks, and input validation on modern devices all appear in the 2025 and 2026 entries, which suggests the list tracks what practitioners are actually looking at now rather than a decade of accumulated classics. ## What this repository cannot do for you The limitations of a link list are real and they should be stated before anyone invests an afternoon in it. The first is that the content is not here. Every talk lives on YouTube, and the visible entries confirm that most links point at youtube.com or youtu.be, with a smaller number pointing at the Chaos Communication Congress media archive. A repository of links inherits the availability profile of those platforms, and it inherits it without any control. A talk that is taken down leaves a link in the list, and the list has no mechanism to notice. The second is that video is not searchable in the way text is. If you want to find the moment in a two hour talk where a particular mitigation is explained, you need a transcript, and the entries do not indicate which talks have captions or a transcript. For a learning resource this is the biggest practical problem, and it is the reason a text resource on the same topics remains valuable alongside this one. The third is that a list of talks is a list of starting points, not a curriculum in the strict sense. Nothing here says what order to watch them in, which ones assume prior knowledge, or which build on each other. The section grouping gives you an index by subject, and the table of contents implies a progression from exploits and attacks through to kernel and supply chain, but the ordering within each section appears to be reverse chronological by the visible entries, with the most recent conference talks first. That is a defensible choice for someone who wants to know what is new, and a poor one for someone who wants a path from the beginning. The fourth is the scope. The list is Android only. iOS research is absent, and the repository name is explicitly Android. The topic tags include recon and general security terms, but the entries are all Android specific, so this is a specialist index rather than a general mobile security reading list. Finally, there is no code, no tooling and no test suite, so there is nothing to build and nothing to integrate. If your goal is to understand a technique, this is a good starting point. If your goal is to detect that technique in a product, you need tooling that this repository does not attempt to provide. ## Using the list without a curator on call The practical way to consume a resource like this is to pick one section and work through it, rather than browsing. Start from the layer your work touches. An application security engineer working on an app that renders remote content has the most to gain from the webviews and JavaScript interfaces section and the input validation and path traversal section, since those are the surfaces they can actually change. A systems researcher will get more from the kernel exploits, baseband attacks and GPU attacks sections. Someone doing hardware or firmware work belongs in the hardware vectors and boot ROM talks. Then treat the venues as a filter on depth. The academic tracks, USENIX Security among them, tend to carry the methodologically careful work, while the hacker congresses carry the findings that have not been peer reviewed, which is exactly where the current, unpolished results live. Both kinds are worth watching, and the fact that the same repository mixes them is convenient. The one thing to do before relying on any of it is check that the talk still exists and that you can follow it. Conference talks from the last two years are the ones that will matter for current Android versions, and the newest entries in the list are Black Hat Asia 2026, OffensiveCon26 and Mobile Hacking Lab Con 2026, so there is a live edge to the collection. For a single entry, a good pattern is to watch the talk once for the attack, then work out from the slides which mitigation applies to the platform version you actually ship, because a talk from 2023 may assume a mitigation that has since shipped or one that was later found incomplete. The list gives you the pointer; the version check is yours. ## Maintenance, licence and the state of the collection The repository is not archived and the last push was on 2026-09-26, so the collection is being kept current, and the visible entries confirm it with talks from Black Hat Asia 2026 and OffensiveCon26 at the top of the relevant sections. There are no GitHub releases, which is consistent with the nature of the artefact. There is nothing to version, because a list of links is one document and updates are edits to it. There is also no CHANGELOG and no indication in the visible entries of a curation policy, such as a rule about which venues qualify or how entries are picked. The selection criteria are implicit in whoever is adding them. The licence is not stated, and the project records it as unknown. For a document of links that is a minor issue, since the links themselves belong to the speakers and the conference organisers, but the compilation is the repository's own work and a licence would tell you what you may do with it. If you want to mirror the list internally, translate it, or fold its structure into a wiki of your own, that is worth asking about first. The homepage is Tenodera.com, and the project sits under the actuator organisation. The top level file list being README.md alone also means there is no infrastructure to maintain, which is a genuine advantage for a resource of this kind, and an equally genuine limitation, since there is nowhere to put transcripts, notes or the scripts that would make the links easier to work with. Taken as a whole, this repository is a well maintained pointer to a large body of public research, organised around the stack rather than around the conferences. Its weakness is that it delegates everything except the ordering to the platform hosting the videos, and that is a limitation you should plan around rather than be surprised by. ## Conclusion Adopt this repository if you are studying Android security and want a structured index of public conference talks rather than a search box, particularly if you are working toward a specific subsystem such as the baseband, the GPU driver or the kernel. Do not treat it as a reference implementation, since it contains no code, no transcripts and no tooling beyond a README. Verify first that the talks you plan to rely on are still hosted where the links point, that the video you need is captioned or transcribed in a form you can search, and that the index still reflects the Android version range you are actually targeting. ## FAQ ### What is the Android Security Exploits YouTube Curriculum? It is a curated list of modern Android exploitation and reverse engineering conference talks, published as a single README in the actuator GitHub organisation, grouped into fourteen topics from exploits and attacks through to kernel exploits and supply chain security. ### Which topics does the curriculum cover? The table of contents lists Android exploits and attacks, permissions and privileges, webviews and JavaScript interfaces, reverse engineering and obfuscation, Bluetooth security, payment systems and ATMs, malware and surveillance, hardware vectors, GPU attacks, baseband attacks, hard coded credentials, kernel exploits, input validation and path traversal, and ecosystem and supply chain security. ### Which conferences are the talks drawn from? The visible entries come from Black Hat Asia across 2024, 2025 and 2026, Black Hat USA 2023 to 2025, DEFCON 32 and 33, the 39th Chaos Communication Congress, OffensiveCon24, OffensiveCon25 and OffensiveCon26, Ekoparty 2025, Nullcon Goa 2023, USENIX Security 2025, SecTor 2025, BSidesLV 2025, Mobile Hacking Lab Con 2026, and the OWASP 2023 Global AppSec DC. ### Does the repository contain any code or tooling? No. The top level contains only README.md, and both the primary language and the licence are recorded as unknown. It is a link index, so transcripts, notes and helper scripts are not included. ### How current is the list? The repository is not archived and the last push was on 2026-09-26, and the newest entries in the visible list are from Black Hat Asia 2026, OffensiveCon26 and Mobile Hacking Lab Con 2026. There are no GitHub releases and no changelog. ## Sources - [actuator/Android-Security-Exploits-YouTube-Curriculum on GitHub](https://github.com/actuator/Android-Security-Exploits-YouTube-Curriculum) - [Issues](https://github.com/actuator/Android-Security-Exploits-YouTube-Curriculum/issues) - [Project website](http://Tenodera.com) - [README](https://github.com/actuator/Android-Security-Exploits-YouTube-Curriculum/blob/main/README.md) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/actuator-android-security-exploits-youtube-curriculum