Discovering vendor-specific vulnerabilities in Android | Oversecured Blog

What it is

Oversecured, a mobile app scanner vendor, extended its Android scanner to cover privileged system APIs. It now has two scan environments, Google and Samsung. The post describes the audit method and three Samsung findings. It says some issues were still unfixed and would be published later.

How it works

The method can be repeated by hand:

1. Collect every .jar from /system/, /system_ext/ and /apex/ (the post used a Google Emulator API 33 image) and decompile and merge them.
2. List the system services the device exposes. The emulator reports more than 250. Most are AIDL interfaces whose names match a Java class, such as android.content.IClipboard.
3. Open each implementation and check how it guards each method. Security rests on per-method permission checks in the service. For example, PowerManagerService.reboot() calls Context.enforceCallingOrSelfPermission() and throws SecurityException without android.permission.REBOOT.
4. For a vendor build, repeat the extraction and diff services and key classes against AOSP. Samsung has around 400 services, and almost every key class differs. The post attributes this to its device ecosystem, extra device configuration options, MDM features and S Pen and S Watch integration.

The post names three kinds of vendor difference: extra permissions, extra protected broadcasts, and extra APIs gated by signature, UID, package name or permission checks.

The scanner also gained two analyses. Control-flow analysis flags an exported component that lets an attacker make a privileged app run an unsafe action. "Dataflow to control flow" finds dynamically created handlers, such as unprotected broadcast receivers or local web servers, whose processing reaches an unsafe action.

Findings

• Missing permission check: AOSP isBackupEnabled() requires android.permission.BACKUP. Samsung's added semIsBackupEnabled() in BackupManagerService returns the same state with no check.
• Broadcast reboot: In Samsung's StorageManagerService, a broadcast with action com.samsung.intent.action.RESTART_OF_SDCARDBADREMOVED_HASAPK reboots the device and bypasses the REBOOT permission.
• LaunchAnyWhere: Samsung extended com.android.settings.homepage.SettingsHomepageActivity with code that lets a third-party app open arbitrary activities. Settings runs as UID 1000 (system), so this reaches non-exported activities of any app.

What to do

For vendor firmware or privileged preinstalled apps, check that every custom AIDL method has its own permission check. Check that custom broadcast receivers do not trigger privileged actions from unprivileged senders. Check that exported components do not forward intents with system identity. The post's own offer is its scanner, which has a two-week free trial.

Caveats

Samsung had fixed more than 60 reported issues, with many outstanding. The post gives no CVE ids, firmware versions or dates. The code listings, including the service-listing snippet, are screenshots and are missing from the fetched text.