Skip to content

Notification Spoofing

Notification Spoofing

Description

The application exposes an input to receive unauthorized notifications, exposing the users to phishing, unauthorized access or even remote code execution.

Notification attacks have leveraged in the by malicious applications like WolfRAT and Mandrake.

A common cause of unauthorized notifications' exposure is insecure or missing permissions on Firebase services or 3rd party push notification like Cordova PushHandlerActivity.

Recommendation

To prevent unauthorized notifications, ensure the following protections are implemented:

  • Notification handling services and activities should be restricted with proper permissions and not be exported/browsable unless necessary.
  • Ensure the permissions are set with secure protection levels appropriate to the application context

For example, if the notification handler activity is com.adobe.phonegap.push.PushHandlerActivity:

<activity android:name="com.adobe.phonegap.push.PushHandlerActivity"
      android:exported="false"/>

Standards

  • OWASP_MASVS_L1:
    • MSTG_AUTH_12
  • OWASP_MASVS_L2:
    • MSTG_AUTH_12
  • CWE_TOP_25:
    • CWE_20
    • CWE_276
  • GDPR:
    • ART_5
    • ART_32
  • PCI_STANDARDS:
    • REQ_6_2
    • REQ_6_3
    • REQ_7_3
    • REQ_11_3
  • SOC2_CONTROLS:
    • CC_2_1
    • CC_4_1
    • CC_7_1
    • CC_7_2
    • CC_7_4
    • CC_7_5