AI 安全
Root Access Can Abuse the Pixel Camera’s Hardware Key to Sign Fake Images, and C2PA Verification Will Still Pass
Security researcher David Buchanan used Keystork to impersonate the camera app and ask Android StrongBox to generate valid Content Credentials for arbitrary AI-generated images. The attack does not require exporting the private key; it exposes how a compromised signing endpoint can abuse a genuine key, rather than a flaw in C2PA’s signature algorithms.
Security researcher David Buchanan has published a proof of concept targeting Android C2PA cameras. He first exploited CVE-2026-43499 to gain root access on a Pixel with a locked bootloader that still reported the latest security update. He then used his custom Keystork service to impersonate Pixel Camera and invoke its Android KeyStore privileges. Buchanan successfully gave AI-generated images valid signatures and certificate chains, causing verification tools to display the content as camera-captured and unedited.
The key point is that the private key is not extracted from StrongBox or Titan M2. The hardware key remains inside the secure element, but a process with root access can impersonate an authorized app and ask the secure element to sign an arbitrary C2PA manifest. Buchanan’s Keystork uses a client/server architecture: a daemon on the rooted device proxies arbitrary KeyStore operations. He also released a Pixel Camera proof of concept for “signing any image.” He says he tested the relevant attack paths on the Pixel 8a and Pixel 9a.
The C2PA specification itself proves only that a particular key signed a specific claim and that the content was not modified after signing. Its draft Android attestation design relies on the StrongBox certificate chain, device state, and app identity to infer that the signing process is trustworthy. If the operating system has been privilege-escalated at runtime while its boot and version measurements remain unchanged, the verifier cannot see that the signing request actually came from an impersonating process.
This does not mean that every C2PA file or dedicated camera hardware can be forged, nor does it mean that the cryptographic signatures have failed. The affected implementations are those that use Android Key Attestation or Play Integrity to establish a “genuine camera” guarantee. Software vulnerabilities can be patched, but Buchanan also demonstrated a path to root access through memory fault injection and said Google classified the hardware attack report as not practically fixable. Deployers should treat Content Credentials as a provenance signal rather than proof of authenticity, and should watch the development of short-lived keys, real-time integrity checks, revocation queries, and designs that move the entire imaging pipeline into a trusted execution environment.