1

Android Application Framework provides a whole bunch of system services, such as PackageManagerService, ActivityManagerSerive. Most of the services are in the System Server process. The framework also provides a whole bunch of APIs to apps in the form of a set of proxy classes, such that when an app invokes proxy.API_foo(), the invocation will be handled, through the Binder mechanism, as a Remote Procedural Call by one of the system services.

My question is that, since all the proxy classes are in the memory address space of the app process, isn't is vulnerable to attacks by a hacked app? E.g., I can overwrite the "this" pointer of a proxy class of interest, such that "this" points to an arbitrary virtual function table.

Does the system provide any write-protection for those proxy class objects, so that they cannot be manipulated?

You may be wondering why I asked this silly question. Some apps rely on system service calls to return correct values for some security purposes:

https://koz.io/inside-safetynet/

I am considering such scenario: assuming you can add code into an app, and the malicious code can manipulate the memory storing the proxy classes, I guess I can hack/fool the high-value app (say a banking app, a health care app) somehow by returning fake values when system service APIs are called.

I found this but don't quite get it: http://shadowwhowalks.blogspot.com/2013/02/android-replacing-system-classes.html

I also found a paper: http://ceur-ws.org/Vol-1575/paper_10.pdf

But the hacking requires the root privilege. Is that really necessary?

Links about System Services:

http://opensourceforu.com/2013/12/birds-eye-view-android-system-services/

https://www.slideshare.net/marakana/android-services-black-magic-by-aleksandar-gargenta

http://resources.infosecinstitute.com/practical-android-phone-forensics/#gref

  • Root access is definitely required to access arbitrary location of the memory by a malicious code. But without root access, this can be achieved by buffer overflow attack on the high privilege app and replacing the pointer to a malicious code. Android uses Address Space Layout Randomization so a malicious app or code doesn't know where the proxy classes are in the memory until it gets root access. – defalt Dec 8 '17 at 19:11
  • If you can add code / modify an app, then you can already modify the app to have whatever different behavior that you want. – Macil Dec 9 '17 at 0:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.