312-50 Question 394
Single answer▪ Mobile Platform Attack VectorsDuring an authorized assessment of a company's Android mobile app, you discover that the app uses an exported activity to handle password reset deep links. The activity does not require a permission, and the app trusts the intent extras without validating the caller or the data source. You want to demonstrate a realistic mobile platform attack vector that could let a malicious app on the same device trigger unauthorized actions in the target app. Which attack is the MOST appropriate to demonstrate?
- A
Intent hijacking by sending a crafted explicit intent with malicious extras to the exported activity
- B
Jailbreaking the Android device to bypass iOS code-signing protections
- C
Exploiting ARP spoofing on the corporate Wi-Fi to directly modify the app's local SQLite database
- D
Performing a SIM swap to intercept the app's exported activity callback
Show answer and explanation
Correct answer: A
Explanation
The best answer is intent hijacking through abuse of an exported Android activity. In Android, exported components can be invoked by other apps unless they are explicitly restricted. If an app exposes an activity and processes intent extras for sensitive actions without validating origin, authenticity, or input values, a malicious local app can trigger unauthorized behavior. This aligns with common mobile platform attack vectors covered in CEH, particularly insecure IPC and component exposure.
From a defensive perspective, Android security guidance recommends minimizing exported components, setting android:exported only when necessary, applying custom permissions where appropriate, validating all incoming intent data, and avoiding trust in caller-supplied extras for security decisions. For deep links, developers should validate URI hosts, paths, parameters, and authentication context before executing sensitive actions. These practices are consistent with Android developer security best practices and OWASP Mobile Application Security guidance, especially around platform interaction risks and improper access control.
- A. Correct.
Correct. On Android, improperly exported components such as activities, services, and broadcast receivers can be invoked by other apps if they are exposed and not protected by permissions. If the target activity trusts unvalidated intent extras, a malicious app can send a crafted explicit intent to trigger sensitive logic such as password reset handling, account linking, or token processing. This is a classic mobile platform attack vector involving insecure inter-app communication and component exposure.
- B. Incorrect.
Incorrect. Jailbreaking applies to iOS, not Android, and bypassing iOS code-signing protections is unrelated to the scenario. The issue described is specifically an Android exported activity with unsafe intent handling. A candidate might choose this because both rooting/jailbreaking and mobile exploitation are common topics, but it does not match the platform or weakness presented.
- C. Incorrect.
Incorrect. ARP spoofing is a network-layer attack and does not directly grant the ability to modify an app's local SQLite database on the device. Even if a tester could manipulate network traffic, that would not be the most direct or appropriate demonstration for an exported Android activity that accepts untrusted intent data. This distractor targets the misconception that any man-in-the-middle position can alter on-device storage.
- D. Incorrect.
Incorrect. A SIM swap is a telecom/social-engineering attack used to hijack phone-number-based authentication, especially SMS-based MFA. It does not target an exported Android activity or demonstrate abuse of inter-app communication. Someone might pick this because password resets sometimes involve SMS, but the scenario specifically highlights unsafe component exposure and intent handling.