Skip to content

Services declared without permissions

Services declared without permissions

Description

service is an application component that can take care of actions to be done in the background, without user interaction. service can also be used to expose functionalities to other applications. This corresponds to calls to Context.bindService() to establish a connection to the service and interact with it.

Unprotected services can be invoked by other applications and potentially access sensitive information or perform privileged actions

Recommendation

service can expose several methods to external components. It is possible to define arbitrary permissions for each method using the method checkPermission.

It is also possible to separate services and restrict access by enforcing permissions in the manifest's <service> tag.

<permission android:name="co.ostorlab.custom_permission" android:label="custom_permission"
            android:protectionLevel="dangerous"></permission>

<service android:name="co.ostorlab.custom_service" android:permission="co.ostorlab.custom_permission">
<intent-filter>
    <action android:name="co.ostorlab.ACTION"/>
</intent-filter>
</service>

The service can enforce permissions on individual IPC calls by calling the method checkCallingPermissionbefore executing the implementation of that call.

Standards

  • OWASP_MASVS_L1:
    • MSTG_PLATFORM_2
  • OWASP_MASVS_L2:
    • MSTG_PLATFORM_2
  • PCI_STANDARDS:
    • REQ_2_2
    • REQ_6_2
    • REQ_6_3
    • REQ_7_3
    • REQ_11_3
  • OWASP_MASVS_v2_1:
    • MASVS_AUTH_1
  • SOC2_CONTROLS:
    • CC_2_1
    • CC_4_1
    • CC_6_1
    • CC_7_1
    • CC_7_2
    • CC_7_4
    • CC_7_5