Android Task Hijacking
Try Hard Security Group
Task, Back Stack and Foreground Activities
In Android, a task is essentially a set of activities that users interact with to complete a specific job, organized within a back stack. This stack orders activities based on when they were opened, with the most recent activity displayed at the top as the foreground activity. At any moment, only this activity is visible on the screen, making it part of the foreground task.
Here's a quick breakdown of activity transitions:
Activity 1 starts as the sole activity in the foreground.
Launching Activity 2 pushes Activity 1 to the back stack, bringing Activity 2 to the foreground.
Starting Activity 3 moves Activity 1 and Activity 2 further back in the stack, with Activity 3 now in front.
Closing Activity 3 brings Activity 2 back to the foreground, showcasing Android's streamlined task navigation mechanism.
Task affinity attack
Overview of Task Affinity and Launch Modes
In Android applications, task affinity specifies an activity's preferred task, aligning typically with the app's package name. This setup is instrumental in crafting a proof-of-concept (PoC) app for demonstrating the attack.
Launch Modes
The launchMode attribute directs the handling of activity instances within tasks. The singleTask mode is pivotal for this attack, dictating three scenarios based on the existing activity instances and task affinity matches. The exploit hinges on the ability of an attacker's app to mimic the target app's task affinity, misleading the Android system into launching the attacker's app instead of the intended target.
Detailed Attack Steps
Malicious App Installation: The victim installs the attacker's app on their device.
Initial Activation: The victim first opens the malicious app, setting up the device for the attack.
Target App Launch Attempt: The victim attempts to open the target app.
Hijack Execution: Due to the matching task affinity, the malicious app is launched in place of the target app.
Deception: The malicious app presents a fake login screen resembling the target app, tricking the user into entering sensitive information.
For a practical implementation of this attack, refer to the Task Hijacking Strandhogg repository on GitHub: Task Hijacking Strandhogg.
Prevention Measures
To prevent such attacks, developers can set taskAffinity to an empty string and opt for the singleInstance launch mode, ensuring their app's isolation from others. Customizing the onBackPressed() function offers additional protection against task hijacking.
References
Try Hard Security Group
Last updated
