task hijacking bug

Task stack hijacking affects apps with startup modes of singletask and standard

We hijacked the task stack of the application by setting the same taskAffinity. When the user clicks on the application, what is actually displayed is the activity of the attack application we wrote (there is no interface switching process in the entire process, which is very hidden and difficult for the user to discover). By designing the activity in this way, we can mimic the login interface of the application, induce the user to log in, and steal the user's private password information

Reproduction method:
Write an attack application that hijacks the application's task stack by setting the taskAffinity attribute to the package name of soul
Expected behaviour
Repair plan

Set the taskAffinity property of the application's activity to empty

When the APP is initially enabled, check whether the number of front-end tasks in the activity stack is greater than the initial set value. If it is greater than the initial set value, it is necessary to draw the user's attention to the possibility of disguised malicious attacks in the future. Do not output sensitive information on the page

Example code:

val activityManager = getSystemService(ACTIVITY_SERVICE) as ActivityManager

val appTasks: List = activityManager.getAppTasks()

if (appTasks.isNotEmpty()) {

Val initial Activity Count=5//Assuming that the initial set number of front-end task activities is 5

val taskInfo: RecentTaskInfo = appTasks[0].taskInfo

val numActivities: Int = taskInfo.numActivities

if (numActivities > initialActivityCount) {

//If the number of activities in the current front-end task is greater than the initial set value, a Toast prompt will pop up to remind the user to pay attention to safety

Toast.makeText (this, "Warning: The current front-end task has an abnormal number of activities, which may pose a security risk. Please be careful not to enter sensitive information on subsequent pages! ", Toast.LENGTH_LONG).show()

}

}

The specific attack video has been attached

[攻击视频1.zip](https://github.com/user-attachments/files/19809478/1.zip)

Start by reviewing the reproduction steps and the proposed taskAffinity change, then inspect the app's Android activity configuration and startup task handling. The issue also proposes checking ActivityManager app-task counts and warning users; completion should address the described task hijacking scenario without exposing sensitive information.

Written by the indexing model from the issue text.