Task hijacking is a security vulnerability in Android that allows a malicious app to take over the identity of a legitimate app, facilitating phishing attacks. Instead of displaying the real app activity, a fake activity is shown, tricking users into revealing sensitive data.
This attack is similar to UI injection, as both involve fake activities imitating legitimate app screens. However, in task hijacking, the malicious activity replaces the original one within the same task, making detection difficult for the user.
Examples of Task Hijacking Attacks
aka StrangHogg attack. Applies for API Level < 30 (Android < 11).
aka StrandHogg 2.0 attack Applies for API Level < 29 (Android < 10).
Key Concepts: Tasks, Back Stack, and Launch Modes
Task Affinity
Task affinity is an attribute defined in the <activity> tag of the AndroidManifest.xml file. It determines which task an activity prefers to be associated with. By default, all activities in an app share the same affinity as their package name.
Example:
<activity android:taskAffinity=""/>
Launch Modes
Launch modes control how activities are launched and managed in a task. They are defined in AndroidManifest.xml or as flags in intents. The four launch modes are:
standard
singleTop
singleTask
singleInstance
For task hijacking, the singleTask mode is most relevant. It ensures that an activity is always the root of its task but allows other activities (with standard or singleTop modes) to join the task.
Proof of Concept (PoC)
Creating a Vulnerable Victim App
To demonstrate the attack, let’s create a vulnerable app (e.g., Super Secure App). Below is its AndroidManifest.xml:
The function moveTaskToBack(true) pushes the activity to the background, making it seem invisible to the user.
How the Attack Works
The victim app (Super Secure App) opens normally.
The attacker app runs in the background and minimizes itself to avoid detection.
When the victim app is reopened, the attacker’s app takes over the task, deceiving the user.
This method can be used for phishing or permission harvesting attacks, making it appear as if the victim app is requesting permissions while actually granting them to the attacker.
Exploiting moveTaskToBack() and excludeFromRecents
The moveTaskToBack() function minimizes the attacker app, keeping it hidden while it remains active. The excludeFromRecents attribute prevents the attacker app from appearing in the recent apps list, making detection even harder.
