Direct Resource Hijacking in Android

Abstract

Android provides flexible inter-application communication by exporting the components of one app to others. Each app can define customized permissions to control access from other apps to its exposed components. However, an attacker can easily access the exported components and private app information by evading permission checks in Android. In this article, the authors discuss a new attack called a direct resource hijacking attack (or resource hijacking attack), which directly hijacks exported components or permissions on components owned by a benign app. They find that among the top 230 popular apps, 53 are vulnerable to this attack. To tackle this vulnerability, they propose a fine-grained resource access control framework in Android and introduce a certificate-augmented resource naming mechanism. With this method, malicious apps cant hijack a victim apps permissions to steal its private data in the victim app, or hijack a victim apps components to retrieve data thats delivered to the victim app. The proposal sheds light on a new design of resource protection in Android.