[BUG]StrandHogg2.0 Restoration suggestions

Open
#846 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
15/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
android, java
Domain
mobile, security

Research direction

The report names no PhotoView files, tests, or code entry points. Start by reviewing the Android 9+ reproduction steps with the target and attack applications, then determine whether the behavior is within this repository's scope. Done requires an agreed fix or explicit scope, followed by verification that the task-stack hijacking no longer occurs.

Written by the indexing model from the issue text.

Description

🐛 Bug Report

Expected behavior

The attacker deliberately did not set the FLAG_ACTIVITY_NEW_TASK flag of the disguised page and placed a disguised page in the task stack of the target application.
When the user clicks the target application icon, pressing the back key will start the Activity of the malicious application written by the attacker. It is difficult for the user to distinguish between the normal page and the disguised page. The attacker can use this to imitate the login interface of the target application and induce the user to enter the account and password, thereby stealing the user's private information.
The attack application is successfully started. When the user initially starts the APP, pressing the back button will display the counterfeit target application interface. The information entered by the user is captured by the attack application. The specific process is shown in the attachment.

Reproduction steps
  1. Write an attack application and set the target application package name and activity name.
  2. Install the attack application on the test device.
  3. Start the target application and observe whether the task stack is successfully hijacked and the activity of the attack application is started.
Configuration

Version: 2.0.0

Platform: 🤖 Android 9+

Dominant language
Java
Stars
18.8k
Forks
3.9k
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Baseflow/PhotoView

All issues in Baseflow/PhotoView

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.