SensitiveCommunication.qhelp

<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
<qhelp>

  <overview>
    <p>When an implicit intent is broadcast in an Android application, if no reciever application or reciever permission is specified, it is visible to all applications installed on the same mobile device, exposing all sensitive information they contain.</p>
    <p>This means that broadcasts that don't specify this are vulnerable to passive eavesdropping or active denial of service attacks.</p>
  </overview>

  <recommendation>
    <p>
      Specify a receiver permission or application when broadcasting intents, or switch to
      <code>LocalBroadcastManager</code>
      or the latest
      <code>LiveData</code>
      library.
    </p>
  </recommendation>

  <example>
    <p>The following example shows two ways of broadcasting intents. In the 'BAD' case, no "receiver permission" is specified. In the 'GOOD' case, "receiver permission" or "receiver application" is specified.</p>
    <sample src="SensitiveBroadcast.java" />
  </example>

  <references>
    <li>
      Android Developers:
      <a href="https://developer.android.com/guide/components/broadcasts">Security considerations and best practices for sending and receiving broadcasts</a>
    </li>
    <li>
      SonarSource:
      <a href="https://rules.sonarsource.com/java/type/Security%20Hotspot/RSPEC-5320">Broadcasting intents is security-sensitive</a>
    </li>
    <li>
      Android Developer Fundamentals:
      <a href="https://google-developer-training.github.io/android-developer-fundamentals-course-concepts-v2/unit-3-working-in-the-background/lesson-7-background-tasks/7-3-c-broadcasts/7-3-c-broadcasts.html">Restricting broadcasts</a>
    </li>
    <li>
      Carnegie Mellon University:
      <a href="https://wiki.sei.cmu.edu/confluence/display/android/DRD03-J.+Do+not+broadcast+sensitive+information+using+an+implicit+intent">DRD03-J. Do not broadcast sensitive information using an implicit intent</a>
    </li>
    <li>
      Android Developers:
      <a href="https://developer.android.com/topic/libraries/architecture/livedata">Android LiveData Overview</a>
    </li>
    <li>
      Oversecured: 
      <a href="https://blog.oversecured.com/Interception-of-Android-implicit-intents/">Interception of Android implicit intents</a>
    </li>
  </references>
</qhelp>