Главная
Study mode:
on
1
Intro
2
Agenda
3
Who we are
4
The Pendingintent API
5
Previous Research
6
Retrieving Pendingintents
7
Hijacking Insecure Pendingintents
8
Deep Dive Into PendingIntent
9
Hijacking Pendingintents with Implicit Base Intent
10
Case Studies
11
POC of CVE-2020-0188
12
CVE-2020-0389: Notification
13
A-166126300: MediaBrowser Service
14
Some High Profile Apps: AppWidgets
15
CVE-2020-0294: System Service
16
Restrictions on URI Grant from uid 1000
17
Hunting Insecure Pendingintents Automatically
18
Search APIs without IMMUTABLE
19
Search Empty or Implicit base Intents
20
Security Changes in Android 12
21
Security Guidelines
22
Final Advice
Description:
Explore a comprehensive analysis of Android PendingIntents vulnerabilities in a 28-minute Black Hat conference talk. Delve into the advanced inter-component communication mechanism and its potential security risks when improperly implemented. Learn about the researchers' findings on exploiting PendingIntents in high-profile and system apps, including case studies of CVE-2020-0188, CVE-2020-0389, and CVE-2020-0294. Discover techniques for retrieving and hijacking insecure PendingIntents, as well as automated methods for identifying vulnerabilities. Gain insights into security changes in Android 12 and receive essential guidelines for secure PendingIntent implementation. Presented by En He, Wenbo Chen, and Daoyuan Wu, this talk offers valuable knowledge for Android developers and security professionals seeking to enhance app security.

A Universal Way to Exploit Android PendingIntents in High-profile and System Apps

Black Hat
Add to list