Inter-App Communication Security Risks

Questions and Answers

The receiving app processes the received data without validating it

Marking the component with android:exported="true" in AndroidManifest.xml

In Android, the recipient app does not need to contain code to handle the incoming communication

Malicious apps can hijack inter-app communication Signup and view all the answers

The app has to contain code to handle the incoming communication Signup and view all the answers

Using an explicit intent with package- or class-name Signup and view all the answers

Study Notes

Receiving app may process received data without validation
App may offer inter-app communication "accidentally", allowing unauthorized access
- Less likely in iOS, as recipient app must contain code to handle incoming communication
- More likely in Android, requiring only minimal configuration in AndroidManifest.xml
Malicious apps can hijack inter-app communication, potentially exposing sensitive data

Activity, Service, or Content Provider must be registered in AndroidManifest.xml
To allow component to be called by other apps, one of two methods can be used:
- Mark component with android:exported="true" in AndroidManifest.xml
- Add an intent-filter to the component, defining a URL scheme or action
Incorrectly exposing Activities or Services can have negative security implications
Example: Exposing an e-banking app's post-login Activity can allow unauthorized access to app functionality