DEF CON 33 - Bypassing Intent Destination Checks, LaunchAnyWhere Privilege Escalation - Qidan He

The talk presents a new Android security vulnerability called "bad resolve" that enables "Launch Anywhere" privilege escalation attacks by exploiting race conditions in the intent resolution process 0:10.

Key Takeaways:
• Intents are the core IPC mechanism in Android, allowing applications to communicate with each other, with security restrictions to prevent unauthorized access to protected components 1:56.
• Historical "Launch Anywhere" vulnerabilities allowed attackers to bypass security checks through intent redirection, initially fixed in Android settings but later bypassed through Parcelable serialization mismatches 6:56.
• The "bad resolve" vulnerability exploits a race condition during intent resolution where the system server and settings application resolve the same intent to different targets during a critical time window 14:11.
• Attackers can extend this brief 1-millisecond window by declaring malformed intent filters with thousands of categories, slowing resolution to 100-400 milliseconds and enabling the race condition 24:26.
• Real-world exploits demonstrated include unauthorized phone calls and accessing protected settings activities, with particular effectiveness on certain Android vendor implementations like Xiaomi, Honor, and Huawei devices 38:07.

These vulnerabilities were responsibly disclosed to Google and demonstrate how Android's complex intent resolution system can be exploited through carefully timed race conditions.

Sources:

• 0:10 Introduction to Android security and "Launch Anywhere" attacks
• 1:56 Explan