Balázs Gerlei
Senior Software Engineer
Nevis Security
Balázs is a software engineer skilled in software architectural design, mobile security, effective product development and agile methodologies. His passion is creating intuitive, experience-focused user interfaces. He is always hungry for more knowledge and happy to share what he learns with others. He likes mentoring and being an enabler in a team. He is a co-organizer of the Android Budapest meetup group. Outside of work he enjoys cycling, photography, cars and coffee.
Don’t Let Attackers Hijack Your App’s Task
Lightning talk
Task hijacking is when a malicious app launches its Activity into the task of another. The trivial counter to the simplest form is to set an empty task affinity for your Activity. That's not all, as the more serious Strandhogg 2.0 exploit doesn't rely on Manifest-based configuration and can dynamically target multiple applications. There is also the fact that the system still allows background apps to launch their Activity on top of others in certain circumstances.
There are mitigations for most attacks on newer Android versions, but if your app needs to be backward compatible, it is entirely on you to apply defense in depth, and I'll show you how, including a quick demo.