C2PA Cameras Do Not Survive Contact With Reality

C2PA 相机无法在现实世界的冲击下幸存

By David Buchanan (aka retr0id), 25th August 2026 作者：David Buchanan (又名 retr0id)，2026年8月25日

You might have heard that C2PA is a technology that will miraculously save us from rampant AI forgeries, by having cameras cryptographically sign the images they capture. Hooray for cryptography! Sorry. That’s not going to work. 你可能听说过 C2PA 是一项能够通过让相机对拍摄的图像进行加密签名，从而奇迹般地拯救我们免受猖獗的 AI 伪造侵害的技术。为密码学欢呼吧！抱歉，这行不通。

There’s a lot going on here, so I’ll try to get to the point as quickly as possible: C2PA camera apps on the Android platform rely on Key Attestation and/or Google Play Integrity, to prevent users from tampering with the app to sign arbitrary files (as opposed to data from the device’s image sensor). Being able to sign arbitrary files breaks C2PA’s trust model. 这里涉及的内容很多，所以我尽量直奔主题：Android 平台上的 C2PA 相机应用依赖于“密钥认证”（Key Attestation）和/或“Google Play 完整性”（Google Play Integrity）来防止用户篡改应用，从而对任意文件（而非来自设备图像传感器的数据）进行签名。能够对任意文件进行签名，就破坏了 C2PA 的信任模型。

Root privilege escalation exploits break Android’s Key Attestation security model, and Play Integrity likewise. Android devices can be rooted via low-cost hardware fault injection attacks. Hardware vulnerabilities in existing devices cannot be patched (there’s nuance here, discussed later). Therefore, C2PA on the Android platform is broken, in a way that cannot be realistically patched. Root 权限提升漏洞会破坏 Android 的密钥认证安全模型，Play 完整性机制也同样如此。Android 设备可以通过低成本的硬件故障注入攻击进行 Root。现有设备的硬件漏洞无法修补（此处有细微差别，稍后讨论）。因此，Android 平台上的 C2PA 是失效的，且这种失效方式在现实中无法通过补丁修复。

None of the above is “0day”, and has been reported to the relevant parties at least 90 days ago (but anyone with their head screwed on should have seen it coming, as many have). But wait, there’s more! Thanks in part to LLMs, root LPEs (Local Privilege Escalations) are coming out faster than Google can ship patches. At time of writing, one-click root exploits exist in-the-wild for fully-patched Google Pixel devices (via CVE-2026-43499). With these, anyone can produce C2PA forgeries without requiring hardware attacks. Later in this article, I’ll provide instructions for doing so. 以上内容都不是“0day”漏洞，且至少在 90 天前就已经报告给了相关方（但任何头脑清醒的人都应该预见到这一点，事实上很多人确实预见到了）。等等，还有更多！部分得益于大语言模型（LLM），Root 本地权限提升（LPE）漏洞的出现速度比 Google 发布补丁的速度还要快。在撰写本文时，针对已完全打补丁的 Google Pixel 设备的“一键 Root”漏洞已经在野外存在（通过 CVE-2026-43499）。有了这些，任何人无需硬件攻击就能制造 C2PA 伪造品。在本文后面，我将提供具体的操作指南。

As you can see, I’m focusing on Android here. I’ll let Google explain why: The Pixel Camera app achieved Assurance Level 2, the highest security rating currently defined by the C2PA Conformance Program. Assurance Level 2 for a mobile app is currently only possible on the Android platform. i.e. I’m attacking the “strongest” implementation, just to make a point. 如你所见，我在这里重点关注 Android。我让 Google 来解释原因：Pixel 相机应用达到了“保证级别 2”（Assurance Level 2），这是目前 C2PA 一致性计划定义的最高安全评级。移动应用的保证级别 2 目前仅在 Android 平台上实现。也就是说，我是在攻击“最强”的实现，以此来证明我的观点。

Here’s an AI-generated slop image, which C2PA says is a real unedited photograph straight out of the Pixel Camera app: (Hover to un-blur, click to “verify” it) And, here’s a Youtube video that the infobox says was “captured with a camera” (spoiler alert: it wasn’t). 这是一张 AI 生成的垃圾图像，C2PA 声称这是一张直接来自 Pixel 相机应用、未经编辑的真实照片：（悬停以取消模糊，点击以“验证”它）。此外，这是一个 YouTube 视频，其信息框显示它是“用相机拍摄的”（剧透警告：事实并非如此）。

Edit, 2026-08-25T19:12:16Z: Google appears to have removed the “Captured with a camera” section from the video description, presumably manually. That doesn’t achieve much—read on to learn how to sign your own media. Also I swapped out the URL for another one. The forgeries will continue until morale improves. 编辑，2026-08-25T19:12:16Z：Google 似乎已经从视频描述中删除了“用相机拍摄”的部分，大概是手动操作的。这并没有什么用——继续阅读以了解如何为你自己的媒体签名。另外，我更换了 URL。在士气好转之前，伪造行为将持续下去。

By the way, Apple is rumoured to be working on their own media provenance solution, but it doesn’t exist yet. I’ll let you know what I think of it, when it does. I suspect their vertical integration will give them a significant advantage, which might shift the lowest-hanging-fruit attacks into the optical domain (taking pictures of screens, etc.) 顺便说一下，有传言称苹果正在开发自己的媒体溯源解决方案，但目前还不存在。等它发布后，我会告诉你我的看法。我怀疑他们的垂直整合将赋予他们显著的优势，这可能会将最容易得手的攻击转移到光学领域（例如拍摄屏幕等）。

Anyway, let’s get into the details. How does root LPE break “hardware-backed” key attestation? Attestation only attests certain things, including: Whether the bootloader is locked. Whether the AVB keys are the vendor’s own. Whether the device is running the latest security update. 总之，让我们深入细节。Root LPE 是如何破坏“硬件支持”的密钥认证的？认证仅能证明某些事项，包括：引导加载程序（bootloader）是否已锁定；AVB 密钥是否为供应商原装；设备是否运行最新的安全更新。

The “normal” way to root an Android device is to unlock the bootloader and flash a modified firmware image, which forces a factory reset of the device in the process. Attestation will flag that the bootloader is unlocked, and Google will refuse to provision C2PA keys to your device (and Netflix won’t serve you high-res content, your banking app won’t work, etc. etc.) So far, so good (if you’re into that kind of thing.) Root Android 设备的“正常”方式是解锁引导加载程序并刷入修改后的固件镜像，这会强制设备恢复出厂设置。认证机制会标记引导加载程序已解锁，Google 将拒绝向你的设备提供 C2PA 密钥（Netflix 也不会向你提供高分辨率内容，你的银行应用将无法工作，等等）。到目前为止，一切正常（如果你喜欢那种方式的话）。

However, if you root a device via an exploit, the attestation mechanism has no reliable way to “notice”. The bootloader is still locked, the AVB keys are unmodified, and the device is still running whatever security update it booted with initially. Now Google’s servers will happily provision keys to a compromised device. 然而，如果你通过漏洞 Root 设备，认证机制就没有可靠的方法来“察觉”。引导加载程序仍然是锁定的，AVB 密钥未被修改，设备运行的仍然是最初启动时的安全更新。现在，Google 的服务器会乐意向一台被入侵的设备提供密钥。

The C2PA keys are still protected by hardware security, inside StrongBox (in Titan M2, on newer Pixel devices). This does stop an attacker from pulling out the keys, even with root. However, an attacker does not need the raw key material! As root, they can ask StrongBox to use these keys to sign whatever data they like, and produce C2PA forgeries (or decrypt your Signal inbox, among other bad things). C2PA 密钥仍然受到硬件安全保护，位于 StrongBox 内部（在较新的 Pixel 设备上的 Titan M2 中）。这确实阻止了攻击者提取密钥，即使拥有 Root 权限也是如此。然而，攻击者并不需要原始密钥材料！作为 Root 用户，他们可以要求 StrongBox 使用这些密钥来签署他们想要的任何数据，并制作 C2PA 伪造品（或者解密你的 Signal 收件箱，以及其他坏事）。

The theory behind the design of the attestation mechanism is that known software LPEs should be patched, and then the Relying Party (the entity verifying the attestation report) can require that users install the updates, and then the updated device can no longer be LPE’d. 认证机制设计背后的理论是：已知的软件 LPE 应该被修补，然后依赖方（验证认证报告的实体）可以要求用户安装更新，这样更新后的设备就无法再被 LPE 攻击。

CVE-2026-43499 is proof that timely patches are not always available, but let’s give everyone the benefit of the doubt and pretend that public exploits for unpatched bugs never exist. There are two remaining problems: Any moderately-well-funded entity, from governments to mobile forensics companies, can build a stockpile of private exploits (and so they do). These are exactly the groups you don’t want to be forging C2PA signatures. Low-cost hardware exploits exist, regardless of patch level. CVE-2026-43499 证明了及时的补丁并不总是可用的，但让我们给所有人留点余地，假设针对未修补漏洞的公开漏洞利用永远不存在。剩下的还有两个问题：任何资金充足的实体，从政府到移动取证公司，都可以建立私有漏洞库（他们确实这么做了）。这些正是你最不希望看到其伪造 C2PA 签名的人群。无论补丁级别如何，低成本的硬件漏洞始终存在。

How did I sign the demo image and video? Initially, I used a hardware attack. It was a continuation of my earlier research: Can You Get Root With Only a Cigarette Lighter? I was going to write about it in-depth here, but frankly the software-only exploit paths stole my thunder. Software exploits are much more convenient when they exist, so I’ll save the full hardware details for another time. There’s no rush, since the hardware exploits can’t be patched, for the most part. If you’d like to reproduce my findings today, I recommend the Root My Pixel tool. (Note: while it supports the latest August security updates of most Pixel devices today, you’ll need to build from main to enable that support. I’ve personally tested on Pixel 8a and 9a.) After getting root, the rest of the attack is just plumbing. I made a tool to facilitate this: keystork. Keystork has a… 我是如何签署演示图像和视频的？最初，我使用了硬件攻击。这是我早期研究的延续：《你只能用打火机获得 Root 权限吗？》。我本打算在这里深入探讨它，但坦率地说，纯软件的漏洞利用路径抢了我的风头。当软件漏洞存在时，它们要方便得多，所以我将把完整的硬件细节留到以后再说。不用着急，因为硬件漏洞在很大程度上是无法修补的。如果你今天想复现我的发现，我推荐使用 Root My Pixel 工具。（注意：虽然它目前支持大多数 Pixel 设备的最新八月安全更新，但你需要从主分支构建以启用该支持。我已经在 Pixel 8a 和 9a 上亲自测试过。）在获得 Root 权限后，剩下的攻击过程只是简单的流程处理。我制作了一个工具来辅助这一过程：keystork。Keystork 有一个……