Android AIDL security

Question

Is there any security provided when an application calls a remote service using AIDL? Or is it simply like a malicious application could read the data?

Pilferage

Answer 1

On Android, one process cannot normally access the memory of another process.

When you bind to applications with a AIDL interface, the system will establish a connection between those processes. Therefor, the only those two applications that can read the information that is shared via the AIDL interface.

If you want to be sure, you should make a extra check in the onBind(Intent intent), to make sure it's your own application that is connecting

Tip: read the first part of this page: http://developer.android.com/guide/components/aidl.html

Lettie

Could you please elaborate on the "extra check in onBind()"? Say I have a remote service in a system application signed with the platform signature. I have my own regular app signed by me, and would like to be certain the service will only accept a bind from my app. How can I guarantee this? – Phthalein

The best thing is to create a permission and check with the getCallingUid() call if that package has the right permission to bind. – Lettie

#12919231 – Ingeringersoll

Answer 2

you could always filter in your methods to restrict the packages that are allowed. Throw a SecurityException if the package does not have permission

Collection<String> callingpackages = getCallingPackages();

if(!callingpackages.contains("yourpackagename"){
//Throw securityException.
}

And getCallingPackages

private Collection<String> getCallingPackages() {
     int caller = Binder.getCallingUid();
     if (caller == 0) {
         return null;
     }
     return Lists.newArrayList(mContext.getPackageManager().getPackagesForUid(caller));
 }

Liquidate

Answer 3

Example security service by signature, by using android:protectionLevel="signature", only app which sign the same signature (same keystore) can bind to your service

AppServer AndroidManifest.xml

<manifest ...>

    <permission
        android:name="my.MyCustomPermission"
        android:protectionLevel="signature" />

    <application
        ...>

        <service
            ...
            android:permission="my.MyCustomPermission">
            ...
        </service>
    </application>

</manifest>

AppClient AndroidManifest.xml

<manifest ...>

    <uses-permission android:name="my.MyCustomPermission"/>

    <application
        ...
    </application>

</manifest>

Immolation

Answer 4

Also, when making service connection to the remote service. specify the package name of the app where service is running.

like this way

Intent serviceIntent = new intent("com.android.vending.billing.InAppBillingService.BIND"); serviceIntent.setPackage("com.android.vending"); bindService(serviceIntent, mServiceConn, Context.BIND_AUTO_CREATE);

Caution: To ensure that your app is secure, always use an explicit intent when starting a Service and do not declare intent filters for your services. Using an implicit intent to start a service is a security hazard because you cannot be certain of the service that will respond to the intent, and the user cannot see which service starts. Beginning with Android 5.0 (API level 21), the system throws an exception if you call bindService() with an implicit intent.

Gourley