Researcher Demonstrates Android App Hacking via Intents

guest · Jun 12, 2020

Researcher Demonstrates Android App Hacking via Intents
...by invoking each of its exposed Activity components
June 11, 2020
https://www.securityweek.com/researcher-demonstrates-android-app-hacking-intents

The issue, Trustwave’s Therese Mendoza explains, isn’t widespread, but it does exist and attackers could abuse it to cause Android apps to leak critical information that could then be abused for further compromise.

Activities, one of the three primary components of Android apps, are called using Intents, which are messaging objects that applications use to communicate with their different components (such as Activities, Services, or Broadcast Receivers).
With every Android application having an AndroidManifest.xml, one can learn detailed information about the app from this file, including declared Intents.
Click to expand...

By using a root ADB shell connected to a device where the application was running, the researcher was able to achieve authentication bypass by sending an Intent to each exposed Activity component.

“By using information contained in the AndroidManifest.xml via an adb shell anyone can explore an Android app for unintended behavior. While the Authentication Bypass here is an extreme example of the type of insecurities that can be found, this technique has been used to find and exploit Android app vulnerabilities for years,” Mendoza points out.
Click to expand...

Trustwave: Compromising Android Applications with Intent Manipulation

The purpose of this post is to highlight this type of vulnerability that still exists in every Android application. While this type of issue isn’t widespread, understanding how this technique was used can help you understand how certain Android apps can leak critical information that can potentially lead to a compromise or breach.
[/qutoe]
Click to expand...

Log in or Sign up

Researcher Demonstrates Android App Hacking via Intents

guest Guest

Log in or Sign up

Researcher Demonstrates Android App Hacking via Intents

guest Guest

Useful Searches