Android Parcels: The Bad, the Good and the Better - Introducing Android's Safer Parcel

An in-depth look at Android Parcel serialization vulnerabilities, exploit techniques like Bundle FengShui, and the introduction of Safer Parcel.

Parcel is the serialization mechanism in Android and is behind almost every OS cross-process interaction. Parcelable implementations have been the source of vulnerabilities in Android for ~8 years, often rated high severity and weaponized by malware authors to achieve privileged exploits, including silent package installation and arbitrary code execution.This talk covers a detailed overview of known exploit techniques that abuse Parcel vulnerabilities, including the well-known yet still active Bundle FengShui exploits; and a novel exploit chain that was reported through Google VRP program (CVE-2021-0928) in June 2021, that achieves arbitrary code execution in privileged applications' processes, on Android 12... By: Hao Ke , Bernardo Rufino , Maria Uretsky , Yang Yang Full Abstract and Presentation Materials: blackhat.com/eu-22/briefings/schedule/#android-parcels-the-b…