Ask Avi - Device Security Lab
A scope-bounded red-team lab for
our phones and our cloud.
An authorized security research lab covering org-controlled Android phones and the Ask Avi cloud (fly.io). This dashboard is the public, sanitized showcase - aggregate run stats and public CVE data only, never device identifiers.
Mission and boundaries
Inside the lab, exercises stay on equipment we own, inside test scope, at a capability level we set. Everything else is out.
In scope
- Org-controlled Android phones and the Ask Avi cloud (fly.io) endpoints
- The RF-shielded enclosure and egress-free emulated builds
- Consented campaign recipients (in-person supply, no automated cold email)
- Already-fixed builds exercised per the public vendor advisory
Out of scope
- No third-party, carrier or inter-networked targets
- No unpatched or novel weaponization, and no denial of service
- No data exfiltration and nothing shipped to a real device
- Novel findings stop on contact and go through responsible disclosure
Two operating modes
Emulated (default)
Egress-free network-namespace bridge plus emulated builds. Zero real devices, isolation enforcement always on.
REDLAB_ENFORCE_ISOLATION=true
Real hardware (gated)
Org-controlled hardware inside the RF-shielded enclosure. Requires a signed scope and the approval stamp in the lab guard before the mode activates.
require_real_hw_mode()
Attack surface
Five remote channels carry the threat model. A sixth, local-app, is never a target by itself - it only counts with a remote leg. Per-channel components, versioning, open-source repos to scan, and reach estimates: the vector source mapping runbook ->
Phone call / telephony
call_telephony
RIL, baseband, IMS/VoLTE/VoWiFi, SIM toolkit and the call path.
Consented call rig (SIP/IMS harness); baseband and RIL checks on the emulated build.
SMS / MMS
sms_mms
SMS/MMS parsers, WAP push, concatenation and OTA settings.
Consented campaign SMS and MMS via the lab SMS gateway with the Mailpit mirror.
Bluetooth BR/EDR + BLE
bluetooth
L2CAP, SMP, GATT, AVRCP, HFP and SPP.
MAC-gated probe rig plus emulated adapter; BR/EDR and BLE sessions inside the RF enclosure.
Wi-Fi / hotspot
wifi_hotspot
WLAN stack, supplicant, WPA2/3, softAP/hotspot and P2P.
Evil-twin / softAP rig (hostapd-mana style) run inside the RF enclosure.
Email delivery
email_delivery
The human-click leg into browser/WebView: MIME, attachments, PDF and link handlers.
GoPhish delivery to consented recipients; link and attachment handling in the WebView sandbox.
Local / app
local_app
Kernel, USB and package-manager rows that an attacker reaches only from a remote channel.
Not a standalone target - only counted when a remote channel above also matches; no app is ever shipped to a device.
The triage pipeline
From device spec to gated test plan - one script does the harvest, a rubric decides the action, and the guard decides who may act.
-
01
Device spec
Probe an org-controlled reference build and record the platform version, security patch level, silicon, baseband and Wi-Fi/BT combo that the search keys off.
collect-specs.sh (adb getprop) -
02
Candidate harvest
CPE and silicon-keyword searches against NVD, joined with the CISA Known Exploited Vulnerabilities catalog, keyword-keyed per attack channel.
cve-scan.sh (NVD + KEV) -
03
Reachability triage
Keep only rows reachable through a remote lab channel; rank worth as KEV first, then CVSS with a short reachable path. Local-only rows are dropped unless known exploited.
cve-scan.sh triage stage -
04
Gated action
Class each row: replicate an already-fixed build in the RF enclosure, build a consented behavioral lure, or hold as review-only for responsible disclosure. Evidence-logged; nothing leaves as a weapon.
guard.sh gates + evidence log
Latest run
A reference Android profile (MediaTek-class silicon), current firmware baseline, triaged against NVD and CISA KEV on 2026-09-19.
Sample triage rows
A curated slice of the run - public CVE data, linked to NVD. Reachable channels reflect only the lab's remote legs. KEV rows are handled first.
| CVE | Published | CVSS | Vector | Reachable via | Worth | Action |
|---|---|---|---|---|---|---|
| CVE-2025-37935 | 2025-05-20 | 9.8 | NETWORK | bluetooth | high | replicate (fixed build) |
| CVE-2026-55366 | 2026-09-15 | 9.8 | NETWORK | bluetooth | high | replicate (fixed build) |
| CVE-2026-67568 | 2026-08-11 | 9.1 | NETWORK | bluetooth | high | replicate (fixed build) |
| KEV CVE-2026-58704 | 2026-09-15 | 8.8 | ADJACENT | bluetooth | high | replicate (fixed build) |
| CVE-2026-21094 | 2026-09-09 | 8.8 | ADJACENT | bluetoothwifi_hotspot | high | replicate (fixed build) |
| CVE-2025-37917 | 2025-05-20 | 7.5 | NETWORK | call_telephony | high | replicate (fixed build) |
| CVE-2026-18907 | 2026-08-05 | 7.5 | NETWORK | email_delivery | high | behavioral lure (fixed build) |
| CVE-2023-53274 | 2025-09-16 | 7.8 | LOCAL | wifi_hotspot | medium | replicate (fixed build) |
| CVE-2025-20979 | 2025-05-07 | 8.4 | LOCAL | bluetooth | medium | replicate (fixed build) |
| CVE-2024-42088 | 2024-07-29 | 7.3 | LOCAL | email_delivery | medium | behavioral lure (fixed build) |
| CVE-2026-28613 | 2026-09-08 | 7.3 | LOCAL | bluetoothemail_delivery | medium | behavioral lure (fixed build) |
| CVE-2026-0054 | 2026-09-08 | 3.3 | LOCAL | bluetoothcall_telephony | low | replicate (fixed build) |
| CVE-2025-38299 | 2025-07-10 | 5.5 | LOCAL | bluetoothcall_telephonyemail_delivery | low | behavioral lure (fixed build) |
| CVE-2026-64461 | 2026-07-25 | n/a | PENDING | bluetoothcall_telephonywifi_hotspot | low | replicate (fixed build) |
Method: KEV first, then high CVSS with a short reachable path. Rows that never touch a remote channel are excluded from the run entirely.
Toolchain
All public, defensive-switchable tooling. No exploit frameworks - the replication floor is the public advisory plus the PoC inside the enclosure.
- guard.sh isolation gate
- Network-namespace test bridge
- AVD emulator (default mode)
- RF-shielded enclosure
- hostapd-mana evil-twin Wi-Fi rig
- MAC-gated Bluetooth probe rig
- GoPhish + Mailpit delivery rig
- NVD/KEV triage scanner with HTTP cache