The Permission Slip Attack

The talk covers a confused deputy problem in Android, where an app holding a sensitive permission exposes a component that a separate, unprivileged app can trigger. The speaker first reviews the permission model, separating normal, runtime and signature permissions, and then compares two intents. The call action can start a phone call without user interaction and maps directly to the call phone permission, while the dial action only pre-fills the dialer. Developers who received reports often replied that the documentation required the permission, which the speaker found to be a misreading of how the platform behaves in practice.

The speaker names the pattern the permission slip attack and presents a command-line toolkit called pslip. It parses manifests for exported components, intent filters that accept call actions or script schemes, and hardcoded AES or DES keys in code. A manifest-only scan takes about five seconds, while adding JADX-based key searches can push runtime to a minute. The speaker showed real findings from recent CVE and bug bounty reports, then ran a short demo in which injected JavaScript exposed a saved password hidden behind asterisks in a browser component.

The closing advice is to stop exporting components that do not need to be exported, prefer inline permissions and tightly scoped intent filters, and avoid hardcoding keys. Custom permissions set to a normal protection level can also be granted without user consent. Questions covered how to score the issue, since opinions differ on whether a pre-installed trigger app counts as a local or network attack, and the speaker noted that a bug bounty program for Google Play had ended.