CARF - Hacking the Android Settings App

The talk looks at a cross-application request forgery bug in the Android Settings app, which the speaker names CARF. Android apps talk to each other through intents, and an exported component can be launched by other apps, including through a web link that the browser converts into an intent. The speaker starts with the framework basics: the manifest, the exported flag, intent filters and how deep links hand URLs to apps.

The investigation then walks through a network settings screen in the Settings app. Its base class validates the requested fragment name when the screen launches, but the handler for re-delivered intents takes a different path, where a null result from the converter skips validation entirely. Intent selectors can carry a valid action past the intent filter while a bogus action reaches the converter. This lets an attacker reach fragments that were meant to be restricted. The most serious one found was a private space deletion screen, which runs its delete routine as soon as it is created, with no confirmation step. A factory reset confirmation was also reachable but crashed because required resources were not loaded.

Google rated the issue high severity and paid a bounty of $8,000 after a 90-day disclosure window. Chrome rejects selectors, while Firefox accepts them, and the default HTML viewer reached from Gmail also works, though those routes need more taps. The takeaways are that intent filters are not access control, every code path that handles intents needs the same checks, and exported components in privileged system apps deserve close review.