Researcher says rooted Pixels can sign AI fakes as genuine C2PA camera captures
- David Buchanan says Android C2PA camera apps trust Key Attestation and Google Play Integrity to restrict signing to sensor output, but a root privilege-escalation exploit lets a compromised locked-bootloader device request signatures for arbitrary files.
- The article says StrongBox hardware prevents extraction of C2PA private keys, yet root access can still invoke those keys to sign attacker-chosen media, which breaks C2PA's claim that a signature represents a camera capture.
- Buchanan cites CVE-2026-43499 and the Root-My-Pixel project as a one-click root path for fully patched Google Pixel devices, removing the need for hardware fault injection to create signed forgeries.
- Google calls Pixel Camera an Assurance Level 2 C2PA generator, the highest current rating, and says Android is the only mobile platform currently eligible for that level; Buchanan presents an AI-generated image and a non-camera video that validate as camera captures.
- The article argues that fault-injection vulnerabilities can root existing Android hardware and cannot realistically be patched, while discussion also points out an optical bypass: a genuine camera can photograph AI content displayed on a screen.
Hacker News opinions
I want to know whether Sony, Leica, and Olympus content credentials do any better at tying a signature directly to sensor output.
They are outside my tinkering budget, though I ordered a faulty Sony A7 IV motherboard. If someone sends me a camera, I'll try to break it, but the faulty board alone may not get me far.
My bet is dedicated cameras do worse. Many DSLRs have had arbitrary code execution, and some even have open-source firmware projects.
I doubt buyers of expensive cameras want invisible watermarks damaging their images.
Even a separate chip in the camera data path is insufficient because TPMs have been broken. Put signing in the sensor and attackers can still photograph a display through optics.
I do not think signatures will decide whether people accept an image as authentic anyway. People with power may be able to add or remove metadata to support whatever story they want.
I can bypass this with no technical skill: put a camera on a tripod in a dark room and photograph a fake image on a good monitor.
Signed focal-length metadata might detect some screen captures, but a planned setup with suitable lenses could hide it.
I am more concerned about journalists' photos after they are edited, downsampled, and reposted to Twitter. That looks like the easiest place to attack provenance.
False promises of reliable photographic evidence are harmful. A system that blocks casual fakes may make the public trust photos more, even when high-stakes actors can pay to forge the proof.
This raises an absurd question: will a real film photograph that I scan be rejected as unreal?
Average users probably will not inspect C2PA data. Google and others have a commercial reason to promote it because provenance can simplify ML training-data preparation and support locked-down, attested operating systems.
I still think it has value even if it is spoofable. It will stop many low-effort users, and anyone assessing high-stakes evidence should already know a camera can photograph a screen.
I do not see a technical solution, but law could require labels on AI images and penalize unmarked posts. Platforms could also identify each post's country of origin so domestic rules can apply.
For agencies, this is advertising compliance. We use C2PA audit trails to show clients that artwork was not AI-generated, and to identify a supplier who cheated under contract or EU AI Act obligations.