AI 安全
Root Access Can Abuse the Pixel Camera’s Hardware Key to Sign Fake Images, and C2PA Verification Will Still Pass
Security researcher David Buchanan used Keystork to impersonate the camera app and ask Android StrongBox to generate valid Content Credentials for arbitrary AI-generated images. The attack does not require exporting the private key; it exposes how a compromised signing endpoint can abuse a genuine key, rather than a flaw in C2PA’s signature algorithms.