(Un)protected Broadcasts in Android 9 and 10
summary
AOSP bug lets apps declare protected broadcast actions but the system fails to honor them when the declaring APK is in non-privileged system locations, so Android 9 and 10 devices allow third‑party apps to spoof those broadcasts. Proofs include a Pixel 4 case where a presence service suffers repeated database corruption, a perf dump app that yields command injection to system uid, and a QMMI path that leaks device IDs; vulnerability scores 7.3 CVSS and CVE assigned Aug 2021. Fix changes the package manager scan flags and is backported.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:28App Components Android apps are composed of app components
- 5:31Who can send protected broadcasts?
- 7:52Which app directories can ...?
- 10:22PackageManager Service Android 10
- 15:53PresencePolling app Overview Communication Services (RCS)
- 18:54Perfdump app Vulnerability Details
- 21:02QMMI app - Exploitation Workflow
- 22:07The (un)protected broadcast fix
related talks
26mStart Arbitrary Activity App Components as the System User Vulnerability Affecting Samsung Android
30mDoes your Android app expose you to excess risk?
53mThe Art of Defense - How Vulnerabilities Help Shape Security Features and Mitigations in Android
56mModern Android Hacking
43mSecurity in Android Applications
41mOverview of common Android app vulnerabilities
35mWhen Security is not a Developer's Fault
29mSecuring Android Applications - The not so se…