Dark Mode

Settings

Capec-502 Detail

Intent Spoof

Standard Software

Parents: 148

Description

An adversary, through a previously installed malicious application, issues an intent directed toward a specific trusted application's component in an attempt to achieve a variety of different objectives including modification of data, information disclosure, and data injection. Components that have been unintentionally exported and made public are subject to this type of an attack. If the component trusts the intent's action without verififcation, then the target application performs the functionality at the adversary's request, helping the adversary achieve the desired negative technical impact.

Not present

External ID Source Link Description
CAPEC-502 capec https://capec.mitre.org/data/definitions/502.html
CWE-284 cwe http://cwe.mitre.org/data/definitions/284.html
REF-427 reference_from_CAPEC https://people.eecs.berkeley.edu/~daw/papers/intents-mobisys11.pdf Erika Chin, Adrienne Porter Felt, Kate Greenwood, David Wagner, Analyzing Inter-Application Communication in Android, 2011, International Conference on Mobile Systems, Applications, and Services (MobiSys)

Not present

  1. An adversary must be able install a purpose built malicious application onto the Android device and convince the user to execute it. The malicious application will be used to issue spoofed intents.

Not present

Not present

Not present

Not present