In this talk, we’ll dive deep into Android’s Inter-Process Communication (IPC) mechanisms, focusing on the security challenges and vulnerabilities that come with them. We’ll start by exploring how IPC functions within the Android architecture, emphasizing its vital role in enabling communication between various components, such as services and activities. We’ll take a closer look at the Android Interface Definition Language (AIDL), which is frequently used to manage more complex IPC scenarios in Android apps. We’ll examine the security model that supports Android’s IPC mechanism and analyze common attack surfaces. By doing so, we’ll highlight the various risks associated with poorly secured IPC channels and the potential consequences of exploitation.

The highlight of our talk will focus on AIDL fuzzing, a powerful and surprisingly simple technique for discovering vulnerabilities in Android’s IPC systems. We’ll introduce the fundamentals of fuzzing and walk you through fuzzing AIDL interfaces to uncover hidden vulnerabilities. Along the way, we’ll cover the tools and scripts built for AIDL fuzzing. For a more hands-on experience, we’ll present our setup and execute an AIDL fuzzing session on a sample vulnerability we identified on an Android interface live.