So uncommon type of vulnerability that we can look at is improper activity exporting and we export activities
essentially let's just start from what exactly is an activity.
That's probably the best place to start here.
And activity is going to be any of the user interfaces that you see instead of the application.
So for instance when I launch up the diva app this main page that we see here is an activity we're looking
at access control it means that certain activities shouldn't be accessible from specific locations.
So for instance if I go to the access control issues you'll see that there's a page here that allows
us to view API credentials and essentially something like this should only be viewable from like a privileged
page.
Right.
So for example if we were to log onto this and be able to access this page that would be OK.
However in some cases these pages are exposed without proper permissions which could potentially allow
someone to be able to launch them if they're export.
So I'll go ahead and I'll walk through what this looks like through Roser and then discuss a little
bit about how you can find these vulnerabilities with DeRosa.
Just to give you a bit more of an idea behind what they look like because trolls are one always pick
up everything and he may be able to access some of these activities with some different permissions
that maybe drove trouser can't access.
So we'll take a look at both of those.
If I wanted to determine which activities are exported I can run the following command here.
We could do run dot activity dot info see hyphen a and then check card.
It seemed like diva and what you'll see is it will show each of the activities that exists.
There's the main activity the API credentials activity in the API creds to activity and you'll see that
both of these have no permissions.
That means that there's no permissions that are required to access them.
So what this means is that I can go ahead and close off this application just to demonstrate this to
you.
And when I do this what I can do is I can run the following comments I can say run up dot civilly dot
start I'm going to target a specific component so the component is the application that we want to target.
So that's the application name and then we see which of the actual activities we want to target.
So for instance I could target the main activity just by typing in main activity and oh I lost connection
here.
I think that's because I closed off theme that draws her out.
So let me let me just relaunch that here so we're just gonna go ahead and reset up our uh our ADP dress
or your top
console connects OK so back where we were before we can we can run the activity starts so we could see
a run up dot activity does start.
And again we could target a specific component.
So you do something like this.
You could say magic ha.
That seems diva.
That's the application that we want to target and then we want to target a specific activity.
So you could do this here.
So that divides dot main activity.
You see when we do this it launches the main activity on my screen here.
So you could see how even without having the application active we'll be able to launch that activity
because there's no permissions associated with it.
And now what we can do is we can launch that API creds activity to it's a API creds activity.
And it looks like oh API is all capitals.
So it's case sensitive.
Just keep that in mind.
And as you can see I can launch the API activity with all the credentials inside of it.
So this is a great example of improper access control because this general activity here should have
some sort of access control it should have some form of permissions associated with it.
However since it doesn't have any permissions associated with it we're able to launch it through Roser
just by using this command.
You can also launch it through ADP using similar commands but dresser it's just like a nice little all
in one place to do it.
So to give you an idea of where you can potentially find these vulnerabilities in general when you're
looking at the android manifest where you're looking at are these these activity blocks here you can
see these ones are mostly relating to strings that are used inside of them.
So a lot of the time strings or something that's coded into the manifest files but a lot of the times
we actually find the actual activity definitions as well.
If we just look for them inside of here.
So these are all of the labels see through all the labels.
Yes you see here for instance like we have the the action domain.
This one is actually an in 24 it's a cure all the activities here.
So you can see the activities here and you can see the activities inside of here as well.
So you can see with API credentials for instance with the API credentials activity with an intent to
be able to view those credentials but without any permissions actually associated with it.
So whenever you see these activities these could be potential things that we might be able to try to
launch inside of inside of the the application.
Right.
So this is the general way that that trouser would be able to find this information is through the manifest.
So you can see like you can find it to the activities inside of here and have names inside of that will
be able to tell you like the the general information about them.
Right.
So this is the general way that Rosa is able to pick up on those.
So running drones will allow you to be able to find these activities and really should try launching
every activity that exists that's exported just to see if one of them might have something that it shouldn't
be exposing to users because if it does that means that violates access control which in turn means
that you know you shouldn't be able to actually access that without permissions.
So that would be a typical type of vulnerability and it would be a fairly critical one to find.
So this is one common type of fund or ability that exists inside of Android.