Baseflow / Baseflow/PhotoView

[BUG]StrandHogg2.0 Restoration suggestions

Open
#846 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
18.8k
Forks
3.9k
PR merge metrics
No merged PRs in 30d

Description

## 🐛 Bug Report

### Expected behavior
The attacker deliberately did not set the FLAG_ACTIVITY_NEW_TASK flag of the disguised page and placed a disguised page in the task stack of the target application.
When the user clicks the target application icon, pressing the back key will start the Activity of the malicious application written by the attacker. It is difficult for the user to distinguish between the normal page and the disguised page. The attacker can use this to imitate the login interface of the target application and induce the user to enter the account and password, thereby stealing the user's private information.
The attack application is successfully started. When the user initially starts the APP, pressing the back button will display the counterfeit target application interface. The information entered by the user is captured by the attack application. The specific process is shown in the attachment.

### Reproduction steps
1. Write an attack application and set the target application package name and activity name.
2. Install the attack application on the test device.
3. Start the target application and observe whether the task stack is successfully hijacked and the activity of the attack application is started.

### Configuration
**Version:** 2.0.0

**Platform:** :robot: Android 9+

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.