1.
Android Apps
Security
Shivasurya S

2.
Android
Architecture
App Space Isolation
Platform & User Apps
Java & Kotlin API ( Additionally Native )
APK and system binary ( Normal Linux )

3.
Attack Surface &
Origin
1. Malicious App
2. Web links with Native Intents
3. Instant Apps
4. WebView API
And even more

4.
Tools 1. Dex2Jar
2. EnJarify from Google
3. Apktool ( Recompile )
4. ADB Commands

5.
Basic
Components
1. Activity
2. Provider
3. Service
4. BroadcastReceiver

6.
Magic of Manifest - AndroidManifest.xml
1. Provides crystal clear exported components
2. Entry point to any component with help of Intent filters
3. Network configurations
4. Permission model & Custom permissions

7.
Rule #1
Exported=”true”
Grab the components which has
exported=”true” attribute from the
Manifest

8.
Rule #2
Permission
Check
Chain with the above Rule #1 and check
for permission check
● Signature
● Normal
● Dangerous
● SystemSignature

9.
Permission example

10.
Rule #3
Intent-filter
actions
Chain with the above Rule #1 & 2 and
check for permission check
● Considered as exported=”true”
● Contains Meta data for
component action
● Filters data type, host, URI path
check
● Fails if exported=”false”

11.
Why Provider
Component ?
1. Provider Exploits
2. Identifying security Impact

12.
Provider Component
1. Provides Data Interface between Apps
2. Returns Cursors & File Objects
3. Whatsapp <-> Contacts Application
4. File Provider and Content Provider

13.
Content Provider Basics

14.
Provider - Vulnerable Code
https://code.videolan.org/videolan/vlc-android/commit/86051dd9753a126e454726d9141566d4b
1999262

15.
Provider - Vector
https://code.videolan.org/videolan/vlc-android/commit/86051dd9753a126e454726d9141566d4b
1999262
content://MASKED_AUTHORITY/databases/history.db
file:///data/data/VULNERABLE_APP_SPACE/database/history.db

16.
Provider - Fixed Code
https://code.videolan.org/videolan/vlc-android/commit/86051dd9753a126e454726d9141566d4b
1999262

17.
Credits : BagiPro ( Hackerone )
1. GrantURIPermission Concept - AndroidManifest
2. Chaining with Open Redirect via Intent
3. Compromising the Provider
Android Open Redirect & grantURIPermissions

18.
Open Redirect

19.
GrantURIPermission - Code

20.
GrantURIPermission - Vector

21.
1. Access all C-R-U-D queries in the provider
2. Direct impact on application sqlite database
3. Check for all tables and dump the database
Exported Provider - Plain Vanilla bug 😊

22.
1. Providers without exported attribute are by open by default in API <
16
2. Apps that are compiled using <= 16 SDK without exported attribute
is open in all API levels ( even above API level 17 )
Attention - Interesting Fact - Platform
Feature/BUG

23.
exported=”true”

24.
Exploit

25.
Before submitting Bug
1. If the provider doesn’t returns data even though the component is
Exported ?
2. What type of data ? ( PII / public data / SD card data )
3. Is Internal App space files are exposed ?
4. Is the provider is behind cryptographic function ( Not an Issue )
5. Signature permission checks and UID check
6. No physical device access or Rooted Device case are accepted

26.
Questions!
Shivasurya S
Zoho Corp.