Inside mobile taint analysis: how source-to-sink tracking finds real data-leak paths | Oversecured Blog

What it is

A vendor post from Oversecured on taint analysis (source, flow, sink) for Android and iOS, with a disclosure of unsafe class loading in Google's com.google.auth.oauth2 Java auth library. Google confirmed the issue, paid a $3,133.70 bounty and fixed it. The page links the fix as a GitHub commit but gives no library version numbers.

How it works

Three credential classes are affected: ComputeEngineCredentials, ServiceAccountCredentials and UserCredentials. Each has a plain string field, transportFactoryClassName, and each implements Serializable through the shared parent OAuth2Credentials.

When an object is deserialized, readObject() runs automatically. It passes the field value to Class.forName(str).newInstance(), so the class named by the attacker is loaded and instantiated.

The page says that on Android any Serializable or Parcelable class in an app can be deserialized from an Intent, even if the app never meant to use it that way. The app cannot check the class type until deserialization has already happened. Per the page, every Serializable class therefore counts as attack surface, and in most cases importing this library is enough to introduce the flaw.

Preconditions / Affected

• The app bundles the com.google.auth.oauth2 library.
• An attacker can deliver a serialized object through an Intent.

The page does not list affected versions or say which apps are known to be exposed.

What to do

The page names no upgrade version. Check the linked fix commit and move to a release that contains it. Because the flaw sits in a bundled dependency, scan the compiled APK, not only your own source, to see whether the library is present. The page says Oversecured's Android analysis works on the APK for this reason.

The page also lists classes of issue that need source-to-sink tracking to detect reliably:

• path traversal and arbitrary file access
• intent redirection
• WebView URL injection
• SQL injection
• token interception through implicit intents
• HTML/JavaScript injection through loadData()
• SSRF

Caveats

• The page is a vendor's description of its own product. It makes no measured false-positive comparison, and the criticism of MobSF is asserted, not benchmarked.
• The scan-coverage figures (180+ Android categories, 80+ iOS) are Oversecured's own.
• The page gives no exploit payload, no impact beyond arbitrary class instantiation, and no date for the disclosure or fix.