The way in which Android applications talk to each other is often misunderstood, and it is entirely too common to see apps whose sensitive functionality is completely open to anyone who asks nicely.

This workshop will cover several case studies of overly permissive apps/devices found in the wild, including an OEM’s voice recorder application that could be made to start and stop voice recordings without the user’s knowledge.

We will go over common implementation flaws, play around with exploiting them from the perspective of an unprivileged application, and explore how an understanding of Android permissions could help us avoid these mistakes.