A Universal Way to Exploit Android PendingIntents in High-profile and System Apps
Explore a comprehensive analysis of Android PendingIntents vulnerabilities in a 28-minute Black Hat conference talk. Delve into the advanced inter-component communication mechanism and its potential security risks when improperly implemented. Learn about the researchers' findings on exploiting PendingIntents in high-profile and system apps, including case studies of CVE-2020-0188, CVE-2020-0389, and CVE-2020-0294. Discover techniques for retrieving and hijacking insecure PendingIntents, as well as automated methods for identifying vulnerabilities. Gain insights into security changes in Android 12 and receive essential guidelines for secure PendingIntent implementation. Presented by En He, Wenbo Chen, and Daoyuan Wu, this talk offers valuable knowledge for Android developers and security professionals seeking to enhance app security.