Bypassing Intent Destination Checks, LaunchAnyWhere Privilege Escalation
Discloses new Intent redirection vulnerabilities in modern Android frameworks that bypass destination checks to achieve LaunchAnyWhere privilege escalation.
Summary
Android Inter-Process Communication and Intents
Android applications and system services rely on Intents to pass data and invoke activities across application boundaries, governed by strict component permission checks.
Bypassing Intent Destination Checks
Qidan He reveals novel parser discrepancies and state inconsistencies in modern Android OS frameworks that allow unprivileged third-party apps to bypass destination validation on PendingIntents.
Executing LaunchAnyWhere Privilege Escalation
Exploiting these Intent redirection flaws enables attackers to launch arbitrary unexported system activities, execute privileged background operations, and achieve full device compromise.
Remediation in Android Platform Frameworks
Securing Android IPC requires operating system updates enforcing explicit Intent matching and strict component permission boundaries.
Related talks
Main Stage·47 min
Qidan He
Demonstrates novel Intent redirection and LaunchAnyWhere privilege escalation techniques in modern Android platform frameworks.
Main Stage·46 min
Xiling Gong · Eugene Rodionov
Vulnerability analysis and exploit primitives targeting mobile GPU drivers to achieve local privilege escalation and Android root.
Main Stage·43 min
Ryan Johnson · Mohamed Elsabagh · Angelos Stavrou
Audits 21 prepaid and 11 unlocked Android smartphones, uncovering privilege escalation, arbitrary file access, and remote command execution in preloaded firmware.