Start Arbitrary Activity App Components as the System User Vulnerability Affecting Samsung Android
summary
Any local app on affected Samsung devices can hand a crafted Intent to com.android.server.telecom (running as the system user) which extracts and starts the embedded Intent as an activity, allowing execution of non-exported components on Android 10–12; Android 9 instead relays embedded Intents as broadcasts. Proof-of-concept exploits perform factory reset, silent install/uninstall of apps, place emergency calls, and install a root CA. Exploit uses the insecure user_select_wifi_service_call receiver; vendor assigned CVE (score 7.8) and confirmed the flaw.
AI-written summary · about
chapters (11)
- 0:00Start
- 3:48App Components Android Apps
- 4:42Intent To Communicate with Application Components
- 6:35Intent Injection
- 7:39Telecom App
- 11:43Workflow Example
- 13:12Root Cause of the Vulnerability
- 16:53Installing an Uninstalling App
- 17:50Uninstalling Apps
- 20:21Calling Emergency Phone Numbers
- 23:34Timeline
related talks
36mPhysical Attacks Against Smartphones
25m(Un)protected Broadcasts in Android 9 and 10
40mDon’t let attackers exploit your app via Intents
56mModern Android Hacking
32mApp-etite for Destruction: a look into the cookbook of an attacker
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
22mA Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps
28mHey Google, Activate Spyware! – When Google Assistant Uses a Vulnerability as a Feature