Android Parcels: The Bad, the Good and the Better - Introducing Android's Safer Parcel
No ratings
Presented at BlackHat Europe 2022 by
Parcel is the serialization mechanism in Android and is behind almost every OS cross-process interaction. Parcelable implementations have been the source of vulnerabilities in Android for ~8 years, often rated high severity and weaponized by malware authors to achieve privileged exploits, including silent package installation and arbitrary code execution.This talk covers a detailed overview of known exploit techniques that abuse Parcel vulnerabilities, including the well-known yet still active "Bundle FengShui" exploits; and a novel exploit chain that was reported through Google VRP program (CVE-2021-0928) in June 2021, that achieves arbitrary code execution in privileged applications' processes, on Android 12. From there, we will discuss why the approach of fixing individual problematic Parcelable classes would not scale and how we broke down the exploits' primitives to fix the root cause. Finally, we will cover security hardening changes of Android 13 that will make Parcel vulnerabilities based exploits a lot harder.This talk is a combination of work from multiple teams under Android Security and Privacy (ASAP), and we will share teams' insights regarding handling Parcel Vulnerabilities and how we are protecting Android users.