Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Entity trail

David Buchanan

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

1

Findings

1

Edges

1

Sources

1

Corpus findings

2026-08-26 / sources-researcherC2PA camera provenance on Android is broken in a way that cannot be patched, using root and a tool that asks StrongBox to sign anythingDavid Buchanan got root on fully-patched Pixel devices two ways, via electromagnetic fault injection flipping page table entry bits and via the public Root My Pixel exploit for CVE-2026-43499. He then used a tool he calls keystork to impersonate the Pixel Camera app and have StrongBox sign arbitrary content with its C2PA credentials, without ever extracting key material from the secure element. That defeats the highest C2PA security rating and by extension every Android camera app relying on Key Attestation or Play Integrity. His conclusion is that the hardware side cannot be fixed in software, so a C2PA signature on an Android photo should not be treated as evidence of capture.

Graph relationships

CRITICIZES
C2PA
David Buchanan demonstrated that C2PA camera provenance on Android cannot be patched due to hardware flaws.
Source finding

Source trail

got root on fully-patched Pixels two ways

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues