In my Android application i have used an intent to start a new activity as shown below:
private void beginVideoChat()
{
Intent intent = new Intent(ProviderDetailsActivity.this, FragmentContainerActivity.class);
intent.putExtra("CommunicationEnum", Communications.Video);
intent.putExtra("provderId", provider.getProviderId());
this.startActivity(intent);
}
Like beginVideoChat(), i have several other methods in which, while defining the intent i have explicitly specified the class name.
When my application was subjected to security testing by the client, I got a security issue known as Intent Manipulation. And the description of the same is given below:
Severity Rating:
Medium
Description:
Allowing user input to control Intent parameters could enable an attacker to control the behavior of the subsequent activity.
Risk:
An intent manipulation issue occurs when the following two conditions are met:
• An attacker is able to specify the action, classname, or component of an Android Intent.
For example, an attacker may be able to specify the classname or the component to handle the intent.
• By specifying the action, classname, or component, the attacker gains a capability that would not otherwise be permitted.
For example, the program may give the attacker the ability to transmit sensitive information to a third-party software on the device.
And the proposed fix generated with the report is:
Do not rely on Intent Filters as a security mechanism. It is too easy to bypass this mechanism by creating specially designed Intents or using explicit Intents.
Remediation:
Do not rely on Intent Filters as a security mechanism. It is too easy to bypass this mechanism by creating specially designed Intents or using explicit Intents.
If private or personal data must be sent, always encrypt it using an industry standard encryption algorithm.
Verify that all Activities have a legitimate need to be publicly exported. If not, remove any Intent Filters from the Activity and make sure the android:explicit attribute is set to false.
The best way to secure an Activity is to rely on permission checks. If it is possible, specify a permission on the receiving Activity that will be used to prevent Intents from being received and handled that do not have that specific permission.
As suggested in the remediation:
If private or personal data must be sent, always encrypt it using an industry standard encryption algorithm => This i would do using and standard encryption algorithm.
My query is how to start any activity without specifying the class name in the intent?
Another query is: How to have some permission check on the receiving activity? =>Inorder to resolve this i would be using Custom Permissions. Is this correct way to handle this?
Thanks in advance.
