Overview

If an exported receiver does not define android:permission with a proper protection level and performs or grants access to sensitive functionality, another third-party app outside the intended trust boundary can send a broadcast to it and invoke that functionality. See MASTG-KNOW-0134 for details on broadcast receivers, MASTG-KNOW-0017 for permissions and protection levels, and MASTG-KNOW-0020 for the IPC model of Android.

This test checks whether the app exposes sensitive functionality through exported and unprotected broadcast receivers.

Steps

  1. Use MASTG-TECH-0013 to reverse engineer the app.
  2. Use MASTG-TECH-0117 to obtain the AndroidManifest.xml.
  3. Use MASTG-TECH-0162 to list the exported broadcast receivers and their associated android:permission, including context-registered receivers found in the code.
  4. Use MASTG-TECH-0014 to inspect the onReceive implementation of each exported receiver.

Observation

The output should contain a list of exported broadcast receivers and the relevant parts of their onReceive implementation, including how they use data from the received intent and any permission they require.

Evaluation

The test case fails if any exported broadcast receiver is not protected by an appropriate android:permission that restricts which apps can send broadcasts to it and exposes or performs sensitive functionality, for example by performing a security-relevant action or disclosing sensitive data when it receives a broadcast.

Further Validation Required:

Inspect each exported broadcast receiver using MASTG-TECH-0023 to determine whether it exposes sensitive functionality:

Then determine whether external access to the receiver is appropriately restricted for the functionality it exposes and the app's intended trust boundary:

Powiązane zgłoszenia

Powiązania
is related to MASTG-BEST-0052 Restrict Access to Android App Components (Android)