A Universal Way to Exploit Android PendingIntents in High-profile and System Apps

Explore a comprehensive analysis of Android PendingIntents vulnerabilities in high-profile and system apps during this Black Hat conference talk. Delve into the intricacies of PendingIntent exploitation, covering topics such as retrieving and hijacking insecure PendingIntents, case studies of CVEs, and automated hunting techniques. Learn about security changes in Android 12 and receive essential guidelines for securing PendingIntents in app development. Gain valuable insights from experts Wenbo Chen, En He, and Daoyuan Wu as they uncover potential privilege escalation risks and provide practical advice for mitigating these vulnerabilities in Android applications.

Intro
Agenda
Who we are
The Pendingintent API
Previous Research
Retrieving Pendingintents
Hijacking Insecure Pendingintents
Deep Dive Into PendingIntent
Hijacking Pendingintents with Implicit Base Intent
Case Studies
POC of CVE-2020-0188
CVE-2020-0389: Notification
A-166126300: MediaBrowser Service
Some High Profile Apps: AppWidgets
CVE-2020-0294: System Service
Restrictions on URI Grant from uid 1000
Hunting Insecure Pendingintents Automatically
Search APIs without IMMUTABLE
Search Empty or Implicit base Intents
Security Changes in Android 12
Security Guidelines
Final Advice