How is Android Firebase messaging SDK secure against Intent spoofing?

user_1841194 0
Viewed 1792

I created a simple project using Firebase Messaging, using the following dependency.

implementation 'com.google.firebase:firebase-messaging:20.0.0'

I have built the app and checked its merged AndroidManifest.xml file. The only exported component by Firebase Messaging SDK is the following receiver:

<receiver
    android:name="com.google.firebase.iid.FirebaseInstanceIdReceiver"
    android:exported="true"
    android:permission="com.google.android.c2dm.permission.SEND" >
    <intent-filter>
        <action android:name="com.google.android.c2dm.intent.RECEIVE" />
    </intent-filter>
</receiver>

I couldn't find the definition of the permission com.google.android.c2dm.permission.SEND, even though I have decoded AndroidManifest.xml of Google Play Services APK and found nothing there. Apart from its definition whatever it is, it cannot prevent a malicious app to use-permission it and broadcast forged Intents. Also because of Intents being delivered by system_server, the receiver cannot check the identity of the sender.

How does Firebase Messageing SDK counterattack this threat?

firebase-cloud-messaging firebase android
1 Answers

A malicious app installed from the Play Store cannot use any permission that starts with "com.google.android". Those are reserved for system privileged apps.

The Play services "backend" app, which is installed on every device that has the Play store, actually handles incoming FCM messages directly. It is a privileged app, and is the only one that will use those permissions to send data to your app.

If you manage to root your device and install a malicious app with system privileges, then you might have a problem. But that's the risk you take when you bypass the security measures built into the device.

user_8071260
Related