Skip to main content

The StrandHogg vulnerability (Task Hijacking) Exploitation

                      The StrandHogg vulnerability (Task Hijacking)

Promon security researchers have found proof of a dangerous Android vulnerability, dubbed ‘StrandHogg’, that allows real-life malware to pose as legitimate apps, with users unaware they are being targeted.


First of all we started with basic knowledge of Activities  and task in android .

You know very well ANDROID SYSTEM IS MULTITASKING SYSTEM






                                                     WHAT IS TASK IN Android?

Task is collection of actiivites in android . like for example: you opened a gmail application .

inbox activity is opened , now you click on message , a new activity is opened .

now, there are two activities but , collection of these activities  is called task. 

Activities are arranged in backstack(stack manner)  - LIFO : LAST IN FIRST OUT.


NOTE: In android Activity Managing Service (AMS) - responsible for managing tasks  in android.







:::  LIFECYCLE OF  TASKS IN ANDROID :






As you know android is multitasking so it give feasibility to developer:


  1. TASK NAVIGATION
  2. UI NAVIGATION
  3. TASK CUSTOMIZATION




SO A Question arising in your ? what the security concern regarding  activity and task in android.

1. Android allows activities from different  apps to reside in same task .
2. Android offers developers great flexibility to customize task behaviour.



To put activity from different  apps into same task taskaffinity comes into play.



                                    ....WHAT IS TASK AFFINITY?

Task affinity specifies which task that the activity desires to join. by default all activities in an app have same affinity - the app package name.

taskaffinty have an attribute  allowtaskreparenting. if allowtaskreparenting=true for activity A of application.and when a task with same affinity as a brought to the foreground, the system would move the A from its original task to the new foreground task.







EXLOITATION CODE:


<activityandroid:exported="true"android:allowTaskReparenting="true"android:taskAffinity="com.tasktest"android:name=".MainActivity">











Comments

Popular posts from this blog

Passcode Protection Bypass By Brute Forcing On zoho (Cliq Application)

First We discuss about what is passcode and Why it is Implemented in  Mobile Applications. PASSCODE Implemented in Mobile Application to protect Applications from an Unauthorized Access.like for example your cliq or any application account is logged in mobile phone .any your friend ask you to give phone , your friend try to open cliq application to see your message, but your friend cant open the application without entering passcode . he have to enter passcode for open, so it is an extra layer security in  applications. Passcode protection implemented in Android Application is an extra layer security to protect an unauthorized access. How Passcode Protection is bypassed by Bruteforcing? You know that passcode protection or pin protection in mobile applications have some attempt to enter passcode , if you enter  wrong passcode more than 5 times or 10 times based on application security , User logged out automatically and redirected to login page.but due to some ...

Exploitation of Improper Export of Activities In Android Application

In android You know that every GUI interface is an  separate activity. An activity represents a single screen with a user interface just like window or frame of Java. In An application there are many activities depend on application functionalities. Let's take a example : An application that have   three modules login , register and   dashboard . For that there are there are three different activities for all these modules. What is export Means Here? In Android Application there is an attribute android: exported =true or false . This attribute is used in android   to provide an access to   other third party application to start their service , activities   and receive broadcast   messages. Like for an Example : If an application    have broadcast receiver to receive any events or message , if in that application exported attribute is set to true then this    broadcast message   can also receive by other thi...

A New Way Of Brute force Passcode/Pin Protection By deep link

DESCRIPTION : AS you know already that what is passcode protection and why it is applied ? And how it is bypassed normally ? If you don’t know please read my previous blog:   https://negativewives.blogspot.com/2020/04/passcode-protection-bypass-by-brute.html                                                                                When any passcode protection is implemented first check any activity is exported or not ? Here we  only talking the scenario where no activity is exported in application   PROCEDURE : Open Application after implementing passcode protection. You see that passcode activity is launched first Go to AndroidMainfest.xml file and check launch mode of passcode activity . Question Arises in your mind   - ...