Android Task Hijacking

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Check the subscription plans!
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}

Try Hard Security Group

{% embed url="https://discord.gg/tryhardsecurity" %}

Task, Back Stack and Foreground Activities

In Android, a task is essentially a set of activities that users interact with to complete a specific job, organized within a back stack. This stack orders activities based on when they were opened, with the most recent activity displayed at the top as the foreground activity. At any moment, only this activity is visible on the screen, making it part of the foreground task.

Here's a quick breakdown of activity transitions:

Activity 1 starts as the sole activity in the foreground.
Launching Activity 2 pushes Activity 1 to the back stack, bringing Activity 2 to the foreground.
Starting Activity 3 moves Activity 1 and Activity 2 further back in the stack, with Activity 3 now in front.
Closing Activity 3 brings Activity 2 back to the foreground, showcasing Android's streamlined task navigation mechanism.

Task affinity attack

Overview of Task Affinity and Launch Modes

In Android applications, task affinity specifies an activity's preferred task, aligning typically with the app's package name. This setup is instrumental in crafting a proof-of-concept (PoC) app for demonstrating the attack.

Launch Modes

The launchMode attribute directs the handling of activity instances within tasks. The singleTask mode is pivotal for this attack, dictating three scenarios based on the existing activity instances and task affinity matches. The exploit hinges on the ability of an attacker's app to mimic the target app's task affinity, misleading the Android system into launching the attacker's app instead of the intended target.

Detailed Attack Steps

Malicious App Installation: The victim installs the attacker's app on their device.
Initial Activation: The victim first opens the malicious app, setting up the device for the attack.
Target App Launch Attempt: The victim attempts to open the target app.
Hijack Execution: Due to the matching task affinity, the malicious app is launched in place of the target app.
Deception: The malicious app presents a fake login screen resembling the target app, tricking the user into entering sensitive information.

For a practical implementation of this attack, refer to the Task Hijacking Strandhogg repository on GitHub: Task Hijacking Strandhogg.

Prevention Measures

To prevent such attacks, developers can set taskAffinity to an empty string and opt for the singleInstance launch mode, ensuring their app's isolation from others. Customizing the onBackPressed() function offers additional protection against task hijacking.