An adversary intercepts an implicit intent sent to launch a Android-based trusted activity and instead launches a counterfeit activity in its place. The malicious activity is then used to mimic the trusted activity's user interface and prompt the target to enter sensitive data as if they were interacting with the trusted activity.
Description
Attack Execution Flow
4
1
Step 1
Explore[Find an android application that uses implicit intents] Since this attack only works on android applications that use implicit intents, rather than explicit intents, an adversary must first identify an app that uses implicit intents to launch an Android-based trusted activity, and what that activity is.
AI Translation
[Trova un'applicazione Android che utilizza intent impliciti] Poiché questo attacco funziona solo su applicazioni Android che usano intent impliciti, piuttosto che intent espliciti, un adversary deve prima identificare un'app che utilizza intent impliciti per avviare un'attività affidabile basata su Android, e qual è questa attività.
2
Step 2
Experiment[Create a malicious app] The adversary must create a malicious android app meant to intercept implicit intents to launch an Adroid-based trusted activity. This malicious app will mimic the trusted activiy's user interface to get the user to enter sensitive data.
Specify the type of intent wished to be intercepted in the malicious app's manifest file using an intent filter
AI Translation
[Creare un'app dannosa] L'attaccante deve creare un'app Android dannosa progettata per intercettare intent impliciti per avviare un'attività affidabile basata su Android. Questa app dannosa imiterà l'interfaccia utente dell'attività affidabile per indurre l'utente a inserire dati sensibili.
Specifica il tipo di intent che si desidera intercettare nel file manifest dell'app dannosa utilizzando un intent filter
Attack Techniques
-
Specify the type of intent wished to be intercepted in the malicious app's manifest file using an intent filter
3
Step 3
Experiment[Get user to download malicious app] The adversary must get a user using the targeted app to download the malicious app by any means necessary
AI Translation
[Indurre l'utente a scaricare un'app dannosa] L'avversario deve convincere un utente, tramite l'app mirata, a scaricare l'app dannosa utilizzando qualsiasi metodo necessario
4
Step 4
Exploit[Gather sensitive data through malicious app] Once the target application sends an implicit intent to launch a trusted activity, the malicious app will be launched instead that looks identical to the interface of that activity. When the user enters sensitive information it will be captured by the malicious app.
Gather login information from a user using a malicious app
AI Translation
[Raccogliere dati sensibili tramite app dannosa] Una volta che l'applicazione target invia un intent implicito per avviare un'attività affidabile, verrà invece avviata l'app dannosa che appare identica all'interfaccia di quell'attività. Quando l'utente inserisce informazioni sensibili, queste verranno catturate dall'app dannosa.
Raccogliere le informazioni di login di un utente usando un'app dannosa
Attack Techniques
-
Gather login information from a user using a malicious app
Mitigations
2
Never Use Implicit Intents For Inter-Application Communication.
To Mitigate This Type Of An Attack, Explicit Intents Should Be Used Whenever Sensitive Data Is Being Sent. An 'Explicit Intent' Is Delivered To A Specific Application As Declared Within The Intent, Whereas An 'Implicit Intent' Is Directed To An Application As Defined By The Android Operating System. If An Implicit Intent Must Be Used, Then It Should Be Assumed That The Intent Will Be Received By An Unknown Application And Any Response Should Be Treated Accordingly (I.E., With Appropriate Security Controls).
Consequences
Security Scopes Affected
Confidentiality
Potential Impacts
Read Data
Relationships
Resources Required
1
Malware capable of acting on the adversary's objectives.