Secure Analysis

I had written a blog about an Android API that can be used to shutdown/reboot an Android device and perform denial-of-service (DoS) attack.  I have found 2 more Android core API's that are vulnerable DoS attacks: - com.android.settings.accoutsyncsettings - com.android.settings.accountSyncSettingsInAddAccount

I had reported a potential flaw in the Android system that could be used to perform DOS (Denial-of-Service) on an Android Phone. The issue was caused by a poor programming assumption which could have been avoided with a good programming 101 course . I had developed a tool called c-ray to help me with quick and dirty pentest and analysis of android applications and system. I stumbled on the issue while playing around with android core system and c-ray application. The issue was caused by an input validation error caused by assumption of the developer. An intent to "android.accounts.GrantCredentialsPermission" class of android core system results in system crash and reboot of the system. Further analysis and reasons below.

I have been wanting to write a blog on this topic for quite a while and finally here I'm. With the rampant adoption and popularity of Android phones, Android apps and android market place are gaining wide spread popularity. I have noticed that most of the apps that we see/use now ask for seemingly harmless permissions like "READ PHONE STATE", "READ_SMS" etc. This post highlights the dangers and security flaws associated with "READ_SMS" permission on Android devices.