The Permission Slip Attack — Leveraging a Confused Deputy in Android with ‘pSlip’

No ratings

Presented at ShmooCon 2025 by

Edward Warren

With Android’s complex permission model, Confused Deputy vulnerabilities present significant risks, allowing attackers to escalate privileges and execute unintended actions. While permission escalation via intent injection isn’t novel, my open-source tool ‘pSlip’ offers a solution to detect instances of these vulnerabilities often overlooked by existing tools. This toolkit parses APK files to extract manifest information and identify exported components (activities, services, receivers) that may expose dangerous permissions or be susceptible to intent injection attacks. The tool detects components with exposed CALL permissions, identifies potential JavaScript injection vulnerabilities via the javascript scheme, and scans for hardcoded AES/DES keys and initialization vectors (IVs) in the application code which could be indicative of insecure cryptographic practices. It also flags custom permissions set to a ‘normal’ protection level, which can pose security risks. ‘pSlip’ AKA ‘Permission Slip’ provides practical ADB commands to test identified vulnerabilities and can generate detailed HTML reports for further analysis. This talk is tailored for anyone interested in mobile app security like security enthusiasts, and developers keen on advancing defensive tooling and security automation.