Главная
Study mode:
on
1
Intro
2
Intents in a nutshell
3
Content Providers (Server)
4
File Providers (server)
5
Content providers - Security
6
Handling a stream
7
Dirty stream attack
8
Creating a malicious provider
9
Carrying The payload
10
Triggering the flow
11
Choosing the payload
12
Misconfigured content providers
13
Code Execution
14
Dynamic Module delivery in a nutshell
15
Securing Share Targets
Description:
Explore the intricacies of Android's intent-based information exchange system and learn about the "Dirty Stream Attack" in this 42-minute conference talk. Dive into how malicious applications can exploit vulnerabilities in receiving apps that blindly trust incoming streams without proper validation. Discover the similarities between this attack and file upload vulnerabilities in web applications. Examine real-world examples of susceptible apps with millions of installations on Google Play Store. Gain insights into creating malicious content providers, triggering attack flows, and choosing effective payloads. Understand the risks of misconfigured content providers and potential code execution vulnerabilities. Learn essential security measures to protect share targets and prevent unauthorized access to sensitive user data.

Dirty Stream Attack - Turning Android Share Targets To Attack Vectors

nullcon
Add to list
0:00 / 0:00