I am a mobile security researcher from Graz, Austria. In 2026, I completed my PhD in Computer Science
under the supervision of Prof. Stefan Mangard at ISEC,
the Institute of Information Security (former IAIK) at Graz University of Technology.
My research revolves around various aspects of mobile security, such as mobile application
security, mobile supply chain security, platform security, and the security of mobile
connectivity.
Interests
Mobile Security
Application Analysis
Platform Security
Supply Chain Security
Wired & Wireless Connectivity Protocols
Education
PhD in Computer Science, 2026
Graz University of Technology
Dipl.-Ing. (MSc) in Computer Science, 2021
Graz University of Technology
BSc in Computer Science, 2017
Graz University of Technology
File-notification subsystems in Linux, Windows, and macOS let unprivileged processes observe file operations, and this paper presents the first generic template attacks exploiting them to spy on user and system activity, such as keystroke timing, website visits, and app usage. Leakage is worst on Windows, where any user can see full paths of files they can’t read, and weakest on macOS, showing this is a cross-platform security problem. My contribution was uncovering that Android’s FileObserver bypasses the FUSE layer meant to isolate apps’ views of external storage.
@inproceedings{Neela2026File,
author = {Neela, Sudheendra Raghav and Zhao, Xufan and Wultsch, Jeanette Angelika and Weissteiner, Hannes and Draschbacher, Florian and Gast, Stefan and Gruss, Daniel},
booktitle = {CCS},
title = {{File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS}},
year = {2026}
}
We systematically analyze the security of state-of-the-art data migration (phone clone) tools from seven major Android vendors—Google, Samsung, Vivo, Xiaomi, Oppo, Huawei, and Honor—whose combined downloads exceed 12 billion. We uncover severe vulnerabilities in all of them, allowing attackers within Wi-Fi range to eavesdrop sensitive user data such as communication records, personal media, and login credentials, with five tools also susceptible to data injection attacks that achieve code execution on a freshly set-up device. We responsibly disclosed our findings to the affected vendors, so far leading to eight CVEs, five of them high-severity.
@inproceedings{Draschbacher2026Clone2Pwn,
author = {Florian Draschbacher and Lukas Maar and Lorenz Schumm and Rene Denifl and Lukas Treffner and Stefan Mangard},
booktitle = {{ESORICS}},
title = {{Clone2Pwn: A Systematic Security Analysis of Data Migration Tools in the Android Ecosystem}},
year = {2026}
}
@inproceedings{Draschbacher2026MisconfiguredSecurityMobilePlatformStack,
author = {Florian Draschbacher},
title = {{Misconfigured Security Across the Mobile Platform Stack}},
year = {2026},
school = {Graz University of Technology},
type = {PhD Thesis}
}
2025
The Doom of Device Drivers: Your Android Device (Most Likely) has N-Day Kernel Vulnerabilities
@inproceedings{Maar2025DeviceDrivers,
author = {Lukas Maar and Florian Draschbacher and Lorenz Schumm and Ernesto Martinez Garcia and Stefan Mangard},
booktitle = {{USENIX Security}},
title = {{The Doom of Device Drivers: Your Android Device (Most Likely) has N-Day Kernel Vulnerabilities}},
year = {2025}
}
In this paper, we introduce ChoiceJacking, a novel USB-based attack exploiting the flawed assumption
that attackers cannot inject input events during data connection establishment. Our platform-agnostic
attack enables a malicious charger to spoof user input, enabling data transfer on Android and iOS.
Testing across devices from 8 vendors reveals critical USB security flaws, allowing sensitive file
access, even from locked devices in some cases.
@inproceedings{Draschbacher2025ChoiceJacking,
author = {Florian Draschbacher and Lukas Maar and Mathias Oberhuber and Stefan Mangard},
booktitle = {{USENIX Security}},
title = {{ChoiceJacking: Compromising Mobile Devices through Malicious Chargers like a Decade ago}},
year = {2025}
}
In this paper, we present the first security analysis of Code Transparency for Android Application
Bundles (AAB). Our analysis uncovers significant shortcomings in Code Transparency, leaving
developers unprotected against supply chain attacks enabled by AAB.
@inproceedings{Draschbacher2024ManifestProblems,
author = {Florian Draschbacher and Lukas Maar},
booktitle = {{ACSAC}},
title = {{Manifest Problems: Analyzing Code Transparency for Android Application Bundles}},
year = {2024}
}
In this paper, we present Defects-in-Depth, a two-fold analysis of the security of downstreamed
Android kernels from the top device vendors. Initially, we analyze one-day exploits and kernel
defense-in-depth mechanisms, allowing us to quantify the level of security that can be reached with
these defenses. We then analyze the effectiveness and inclusion of the defenses in downstreamed
Android kernels and found that the level of security that is actually reached is severely lacking.
@inproceedings{Maar2024DefectsInDepth,
author = {Lukas Maar and Florian Draschbacher and Lukas Lamster and Stefan Mangard},
booktitle = {{USENIX Security}},
title = {{Defects-in-Depth: Analyzing the Integration of Effective Defenses against One-Day Exploits in Android Kernels}},
year = {2024}
}
In this paper, we present A2P2, a flexible application-agnostic patching pipeline for various aspects
of compiled Android applications.
@inproceedings{Draschbacher2023A2P2,
author = {Florian Draschbacher},
booktitle = {{ARES}},
title = {{A2P2 - An Android Application Patching Pipeline Based On Generic Changesets}},
year = {2023}
}
In this paper, we present CryptoShield, an approach for automatically detecting and mitigating
cryptographic API misuse in compiled Android applications directly on the device.
@inproceedings{Draschbacher2023CryptoShield,
author = {Florian Draschbacher and Johannes Feichtner},
booktitle = {{AsiaCCS}},
title = {{CryptoShield - Automatic On-Device Mitigation for Crypto API Misuse in Android Applications}},
year = {2023}
}
