CAPEC-501: Android Activity Hijack

MITRE CAPEC attack pattern

Description

An adversary intercepts an implicit intent sent to launch a Android-based trusted activity and instead launches a counterfeit activity in its place. The malicious activity is then used to mimic the trusted activity's user interface and prompt the target to enter sensitive data as if they were interacting with the trusted activity.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-923

Prerequisites

• The adversary must have previously installed the malicious application onto the Android device that will run in place of the trusted activity.

Skills required

• High: The adversary must typically overcome network and host defenses in order to place malware on the system.

Consequences

• Confidentiality: Read Data

Mitigations

• To mitigate this type of an attack, explicit intents should be used whenever sensitive data is being sent. An 'explicit intent' is delivered to a specific application as declared within the intent, whereas an 'implicit intent' is directed to an application as defined by the Android operating system. If an implicit intent must be used, then it should be assumed that the intent will be received by an unknown application and any response should be treated accordingly (i.e., with appropriate security controls).
• Never use implicit intents for inter-application communication.

Source

• MITRE CAPEC CAPEC-501