CVE-2014-N/A com.android.contacts

Date: 2014-07-04 11:46:39

Introduction

This bug is similar to CVE-2013-6272 but is only exploitable on older Android versions. The bug exists in the component com.android.contacts.

Credits

Authors: Marco Lux, Pedro Umbelino
Email: security@curesec.com

Affectect Versions:

This bug is not related to CVE-2013-6272 but has the same result. Reading the source code it probably exists at least from version 1.5. However we have only tested with SDK 10.

The Bug was corrected in version 3.0, SDK 11. Still, we would be interested in feedback by people testing the supplied exploitation techniques with their testdevices.

The bug is located in src/com/android/contacts/ContactsListActivity.java. Like in CVE-2013-6272, this activity is exported when it probably should not.

When this activity is created it parses the Intent for which it has been called:

This basically means we can fool the activity into thinking we clicked on the dial number of a search suggestion and make it call any number we want since the number comes from intent.getData(). This also works for MMI and USSD codes (those that would normally require the user to press the SEND button after the code, android secret codes don't work nor *#06# to see the IMEI for example).

In conclusion this bug can be exploited as CVE-2013-6272, but it has a different codebase.

Exploitation

For the audience to play, test and execute the vulnerability we provide the following tools:

• Test application “CRT-Kolme” (includes CVE-2013-6271, CVE-2013-6272 and CVE-2014-NA)
• Exploits to use with drozer
• Manual drozer testing commandlines

CRT-Kolme

You can download “Curesec Research Team – Kolme (Callmeh)” at

https://curesec.com/data/CRT-Kolme.apk

Source Code: https://curesec.com/data/CRT-Kolme.7z

After installation just click on the Curesec Logo and the testscreen will appear:

Choose the SDK you want to test. If your phone is vulnerable, it will call the number 31337:

Exploits for drozer

Drozer Commandline Foo

Call any number:

In order to make the codes work, you can use the following command:

The usual # symbol for the MMI codes has to be replaced by %23 to work properly.

FAQ

Android normally has to grant permission so that your applications can conduct actions. If your installed application does not own the right to do a phone call, the Android OS should throw a permission denied.

However this bug is circumventing the situation and allows any malicous app to do a phone call, send mmi or ussd codes or hangup an ongoing call.

You can use the APK we published. You will find details in the next sections.

This bug can be abused by a malicious application. Take a simple game which is coming with this code. The game wont ask you for extra permissions to do a phone call to a toll number, however it is able to do it.

This is normally not possible without giving the app this special permission. But not only might it be disturbing or expensive for someone to call a toll number or getting ongoing calls hung up. It is also possible to send USSD or MMI codes.

The list of USSD/MMI codes is long and there are several quite powerful ones like changing the flow of phone calls(forwarding), blocking your simcard, enable or disable caller anonymisation and so on.

Please note that curesec GmbH is not responsible for any damage your device might suffer while you try to execute such codes.

No. As the app does not have the permission but is abusing a bug, such apps cannot easily protect you from this without the knowledge that this bug exists in another class on the system.

security@curesec.com

Timeline

Downloads