Dirty Stream Attack, Turning Android Share Targets Into Attack Vectors
summary
Crafted a malicious ContentProvider that spoofs the display_name and returns a file descriptor stream so a share-target app caches or writes attacker-controlled files into its app home; tested 20 popular apps (>100M installs) and finds over half vulnerable, with 28 full code executions and 18 sensitive disclosures. Demonstration overwrites a Play Core plugin in a browser with ~500M installs, causing execution of a bundled native library. Mitigations: ignore or sanitize display_name, validate cache paths and avoid loading libs/Dex from app data or untrusted streams.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:26Briefing outline
- 2:30Android content providers
- 6:01File providers in sharing
- 9:15Permissions and access
- 11:42Share targets in Android
- 14:52Share target code patterns
- 15:56Dirty Stream attack model
- 17:20Rogue APK crafting
- 20:48Exploitation impact
- 22:55Reading sensitive files
- 25:00Vulnerable apps stats
- 25:43Live code demo
- 29:35Securing Android apps
- 31:22Key takeaways
related talks
17mSidewinder Targeted Attack Against Android in the Golden Age of Ad Libs
15mExploiting Android Apps with Counterfeit Art
27mBypassing Browser Security Policies for Fun and Profit
07m"The significance of mobile exploit applications"
30m"Latest Android threats and their techniques"
40mSecurity: The Hidden Cost of Android Stalkerware
35mPractical Mobile App Attacks By Example
32mApp-etite for Destruction: a look into the cookbook of an attacker