Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm starting android bug hunting and I've seen a service with implicit intent, and I saw in Android documentation that :
Using an implicit intent to start a service is a security hazard because you cannot be certain of the service that responds to the intent
The service is derivated from FirebaseMessagingService. I would like to know if this is a security issue and If it is what would be the impact ?
Thanks
The extension of FirebaseMessagingService is usually used to process the notification messages when the application is in foreground. The processing is automatically done by the system when the application is in background. Based on my research and understanding, this service is started by the system and once the notification message is received the onMessageReceived() is invoked. In this case, I don't see usage of implicit intent for invoking a service as a security issue. Also, as per the official documentation, to use this functionality the service is to be declared in the manifest in the predefined way which seems to be a functional requirement.
Recommended Read: https://medium.com/@MiBLT/mastering-firebase-notifications-36a3ffe57c41
PS: While answering the question, I'm assuming that you are performing bug hunting on the Android application using Firebase component and not the component itself.
