Multiple Rakuten Mobile smartphones shipped with a known private test key for Android Verified Boot

Rakuten Mobile, Inc. distributed several smartphone models that use the default Android Open Source Project (AOSP) test keys for Android Verified Boot (AVB). AVB is designed to ensure the integrity of the device's boot process by verifying cryptographic signatures. Using known test keys undermines this security mechanism because attackers can potentially sign malicious boot images with the same keys, bypassing AVB protections.

The use of publicly known private test keys for AVB weakens the device's boot integrity verification. This could allow attackers with physical or software access to the device to load unauthorized or malicious boot images, potentially compromising device security and user data. However, no known exploits are reported in the wild for this issue.

No specific patch or remediation details are provided. Since this involves device firmware and key management, remediation would typically require the vendor to issue updated firmware signed with unique production keys. Users should monitor Rakuten Mobile advisories for official fixes or device replacements. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.