https://twitter.com/revskills/status/643875969896456192

Wow, this is first I’ve heard of this tool! The readme mentions prior art, at least one related tool, as well.

Excerpt from the blog:
Announcing Android Vulnerability Test Suite
Today, NowSecure is releasing to the public an open source Android Vulnerability Test Suite (Android VTS). Ryan Welton (@fuzion24) has worked particularly hard to produce a tool that can be used by researchers and users alike to determine the vulnerability status of their devices. In the spirit of open data collection, and with the help of the Android CTS, we are opening Android VTS to the public and the mobile security research community with the hope that together we can take an accurate pulse on the state of Android security. In time, NowSecure’s research team will add patches to the VTS to introduce an opt-in module for anonymized results to be shared to a central server for the purpose of open security research. With this release we provide the code and compiled APK to begin checking the vulnerabilities immediately. Pull requests welcome!

Excerpt from the code’s readme:

Implementation
Vulnerabilities in a device can exist at many layers inside of Android. For example, a bug can exist in the kernel (Towelroot, for example) or it can exist in the Android specific framework (Android Masterkeys/FakeID). Some of the kernel bugs can sometimes be difficult to check for without potentially causing system instability. This implementation takes care to not include checks that could cause instability problems for the end user and therefore may omit checks that could cause these types of issues. The framework is very thin at the current time and consists of a vector of vulnerability checks. Their concrete implementations vary wildly depending on the bug. A list of current bug checks:

    ZipBug9950697
    Zip Bug 8219321 / Master keys
    Zip Bug 9695860
    Jar Bug 13678484 / Android FakeID
    CVE 2013-6282 / put/get_user
    CVE_2011_1149 / PSNueter / Ashmem Exploit
    CVE_2014_3153 / Futex bug / Towelroot
    CVE 2014-3847 / WeakSauce
    StumpRoot
    Stagefright bugs
    x509 Serialization bug
    PingPong root – CVE-2015-3636

More Information:

https://github.com/nowsecure/android-vts

https://www.nowsecure.com/blog/2015/09/14/announcing-android-vulnerability-test-suite/