Start Arbitrary Activity App Components as the System User Vulnerability Affecting Samsung Android Devices
No ratings
Presented at BlackHat Asia 2022 by
Samsung Android devices running Android versions 9, 10, 11, and 12 contain a vulnerability that allows any local app on the device (including third-party apps with zero permissions) to provide arbitrary Intent objects that will be used by a pre-installed app (com.android.server.telecom) executing as the system user to start an activity app component (even those that are not exported) of the attacker's choosing, affecting Android versions 10, 11, and 12. The same vulnerability is present on Android 9, although it allows zero-permission third-party apps to provide arbitrary Intent objects that are sent to broadcast receiver app components by the same vulnerable pre-installed app executing as the system user (instead of being used to start arbitrary activity app components in more recent Android versions). This vulnerability allows a third-party app to provide arbitrary Intent objects that will be started by a pre-installed app executing as the system user with all its permissions, privileges, and capabilities. This systemic vulnerability introduces additional privilege escalation vulnerabilities since the underlying vulnerability allows a third-party app to start and send data to arbitrary activity app components (broadcast receiver app components for Android 9) in the context of a system user pre-installed app. This opens a large attack surface for third-party apps by allowing it to send arbitrary Intent objects with embedded data to activities (and broadcast receivers for Android 9) that appear to originate from the system itself. In effect, an unprivileged app can use an unprotected interface to send Intent objects to perform actions on its behalf. A limited sample of unauthorized capabilities that a zero-permission third-party app can gain by starting arbitrary activity app components on a Samsung S21 Ultra 5G running the most recent Android 12 build available to it using a system user pre-installed app to start activities on its behalf are the following: factory reset, install arbitrary apps, uninstall arbitrary apps, call phone numbers, call privileged phone numbers (e.g., such as 911), and install a custom certificate authority. All of these aforementioned capabilities are performed programmatically without any user involvement. This is a limited sample of vulnerabilities that are made accessible to third-party apps via the vulnerable pre-installed app that "forwards" attacker-controlled Intent objects and starts them as the system user.