0

I would like to know if there is an attack that allows an installed Android application to acquire further permission that is not assigned initially during installation.

I did some research and found that there is a method called "Permission Re-Delegation" which allows for other additional permission by targeting the authorized applications via IPC mechanism. Are there any other methods or names of malware that already take advantage of this vulnerability?

Paradox
  • 188
  • 11
Nimpo
  • 121
  • 1
  • 1
    *Are there any other methods or names of malware that already take advantage of this vulnerability* is a [shopping list question](http://meta.stackexchange.com/questions/158809/why-are-shopping-list-questions-bad), these are considered too broad for StackExchange sites. Can you [edit] your question and make it more specific? –  Jun 28 '16 at 19:54
  • I don't get it. If you replaced "Android application" with "car" and "permission re-delegation" with "remote exploitation of an unaltered passenger vehicle" you **literally** get [this question](http://security.stackexchange.com/q/128462/86652) which was accepted and scored high. – techraf Jun 29 '16 at 00:24
  • Note that calling another application via IPC to do something the current app cannot is not a vulnerability on its own. It is the responsibility of the application being called to check the parameters and access permissions. – billc.cn Jun 29 '16 at 12:42

1 Answers1

1

What you are asking about is known in the hacking world as "Privilege Escalation". It's a fairly broad term that encompasses a lot of techniques over a lot of operating systems and platforms, but is generally taken to mean exploiting a bug or flaw within a system to gain additional levels of access -generally administrative in nature.

To my knowledge there is no method available to do this on the current version of the Android OS and I suspect it would be regarded as a 0-day if it were possible. It's also important to consider that these types of exploits may be Phone specific, as each manufacturer applies their own "skin" to the stock Android OS. If you are looking for bugs in older versions of Android, you may want to check something like exploit-db.com. Here's one from back in March for Android One.

HashHazard
  • 5,105
  • 1
  • 17
  • 29