Thursday, July 18, 2024

Android Application Penetration Testing – Part 10

Attacking Broadcast receiver:

A Broadcast Receiver is an Android Component which allows you to register for system or application events.We recommend reading Android Penetration Testing – Part 5 for more details with Broadcast Receiver

 Let’s examine android manifest

Broadcast receivers are generally registered in the following format. As we can see in android manifest file exported value = True for broadcast

The code seems insecure since the receiver is exported.

The parameters that are passed to the Broadcast Receiver can be seen below

The Goal is to send spoofed broadcast intents and see if the application is accepting them. If yes, we will exploit the application to send an SMS to some random mobile numbers using the fake broadcasts.

  • Attacking vulnerable broadcast receivers
  • Securing the applications

Attacking Vulnerable Broadcast Receivers

Let’s now try to send some spoofed broadcasts to the above receiver.

Using am tool available in adb

Using adb

  1. Get an adb shell on the device and type the following command to send a spoofed broadcast.
  2. Navigate back to the “platform-tools” folder and enter the below mentioned command:

. /adb shell

  1. Enter the following command in the shell:

am broadcast -a theBroadcast -n –es phonenumber 5554 –es newpass Dinesh@123!

  1. Back on the emulator, navigate to the “Messages”. The above-entered command automatically makes a call to the mentioned Broadcast Receiver and an SMS text with the passwords is sent.

Now, a broadcast event is sent in the background, and since the application is not validating the input source, an SMS will be sent to emulator-5554 without user intervention.

Let’s see how we can secure application-

Securing the Applications:

  • Setting android: exported attribute’s value to false

In the AndroidManifest.xml file of our application, we should add the following attribute to the receiver to be secured.

  • Limiting access to custom permissions

We can also impose permission-based restrictions by defining custom permissions for each receiver. This is helpful if the developer wants to limit the access to his app’s components to those apps which have permissions.

This is the reason why we need to specify “android.permission.RECEIVE_SMS” permission in the AndroidManifest.xml file if any app wants to listen for the Receive SMS event using the action “android.provider.Telephony.SMS_RECEIVED“

Check out our previous parts of Android Penetration Testing

Android Application Penetration Testing – Part 1
Android Application Penetration Testing – Part 2
Android Application Penetration testing – Part 3
Android Application Penetration Testing – Part 4
Android Application Penetration Testing – Part 5
Android Application Penetration Testing – Part 6
Android Application Penetration Testing – Part 7
Android Application Penetration Testing – Part 8
Android Application Penetration Testing – Part 9


Latest articles

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which...

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and...

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are...

Hackers Exploiting Legitimate RMM Tools With BugSleep Malware

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has...

Cybercriminals Exploit Attack on Donald Trump for Crypto Scams

Researchers at Bitdefender Labs remain ever-vigilant, informing users about the latest scams and internet...

New TE.0 HTTP Request Smuggling Flaw Impacts Google Cloud Websites

HTTP Request Smuggling is a flaw in web security that is derived from variations...

Volcano Demon Group Attacking Organizations With LukaLocker Ransomware

The Volcano Demon group has been discovered spreading a new ransomware called LukaLocker, which...

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles