I recently did a code scan on my Android source code using HPFortify service. They reported security vulnerability regarding google analytics receiver. They suggested to use the broadcaster permission to reduce the attack vector. This way you are restricting broadcaster, otherwise any malicious application can send the intent and broadcast receiver will process it.
Here is my AndroidManifest file.
<receiver
android:name="com.google.android.gms.analytics.AnalyticsReceiver"
android:enabled="true">
<intent-filter>
<action android:name="com.google.android.gms.analytics.ANALYTICS_DISPATCH"/>
</intent-filter>
</receiver>
<service
android:name="com.google.android.gms.analytics.AnalyticsService"
android:enabled="true"
android:exported="false"/>
I am trying to figure out the broadcaster permission for AnalyticsReceiver. According to HpFortify the broadcast receiver should look like similar to this:
<receiver
android:name="com.google.android.gms.analytics.AnalyticsReceiver"
android:permission="SOME-GOOGLE-ANALYTICS-PERMISSION"
android:enabled="true">
<intent-filter>
<action android:name="com.google.android.gms.analytics.ANALYTICS_DISPATCH"/>
</intent-filter>
</receiver>
Edit 1:
I am also looking for the source code to figure out the right permission. But I couldn't find the google analytics source code.
Related
Like to confirm if we can set android:exported="false" for instance id service and messaging service.
I tested by keeping android:exported="false" and notifications are working fine.
<service
android:name=".MyFirebaseMessagingService"
android:exported="false">
<intent-filter>
<action android:name="com.google.firebase.MESSAGING_EVENT"/>
</intent-filter>
</service>
<service
android:name=".MyFirebaseInstanceIDService"
android:exported="false">
<intent-filter>
<action android:name="com.google.firebase.INSTANCE_ID_EVENT"/>
</intent-filter>
</service>
The firebase-messaging library exports an unspecialized FirebaseMessagingService of its own with low priority (-500). You can see it in your merged AndroidManifest.xml. This service can handle the push messages that carry notifications, like the ones you can send through the Firebase console.
If your specialized service class isn't exported, then the system will route messages from the Google services package to this unspecialized service, and notifications will work fine.
But that means you wouldn't be able to, for example, perform other actions when receiving a message or process custom data payloads.
You should export the service to be sure it is handled by your class as specified by #guest
<service
android:name=".services.MyFirebaseMessagingService"
android:exported="true">
<intent-filter>
<action android:name="com.google.firebase.MESSAGING_EVENT" />
</intent-filter>
</service>
I have a broadcastReceiver registered in manifest that receives broadcasts sent from one of my services with a custom action. I have it already working but for security reasons i want to prevent other apps from sending fake broadcast to my receiver. How can i do that?
Manifest
<receiver android:name=".MyReceiver">
<intent-filter>
<action android:name="MyAction"/>
</intent-filter>
</receiver>
Every reciever with exported tag set to false will only receive broadcasts sent from its own application process.
so it will be:
<receiver android:name=".MyReceiver"
android:exported="false">
<intent-filter>
<action android:name="MyAction"/>
</intent-filter>
</receiver>
As another solution i found that i can use permissions.
more on here
The Pebble Docs clearly describe how to start a watchapp on the Pebble from an Android app, but I cannot find instructions on how to start an Android app from a watchapp. Is that possible, and how?
It's possible by registering a broadcast receiver for the pebble events, here's the code:
<receiver android:exported="true" android:name=".MyBroadcastReceiver">
<intent-filter>
<action android:name="com.getpebble.action.app.RECEIVE"/>
<action android:name="com.getpebble.action.app.RECEIVE_ACK"/>
<action android:name="com.getpebble.action.app.RECEIVE_NACK"/>
</intent-filter>
</receiver>
Hi I'm Android developer, and I met a challenge about using Google Analytics Campaign using SDK v4.x.
I have refered to the following URL
https://developers.google.com/analytics/solutions/testing-play-campaigns
And I finished the step of 'Broadcasting an INSTALL_REFERRER Intent'
Because I could see this message successfully.
Broadcasting: Intent { act=com.android.vending.INSTALL_REFERRER
cmp=com.example.analyticsecommtest/com.google.analytics.tracking.android.AnalyticsReceiver
(has extras) }
Broadcast completed: result=0*
But I found this log :
Thread[GAThread,5,main]: No campaign data found.
The reference URL said, the log means that my Google Play Campaign Measurement implementation is not working correctly. Thus I tried to fix the work as checking out troubleshooting section.
there are several reasons.
The INSTALL_REFERRER intent was not broadcast
-> I finished it as I told
The Google Analytics Receiver did not receive the intent
-> I implemented CampaignTracking correctly, I think.
and only CampaignTrackingReceiver uses INSTALL_REFERRER.
Now, What can I do to implement CampaignTracking successfully?
and do I need to implement Receiver.class that extends BroadcastReceiver? (even I use SDK v4.x)
one more question, if I send setCampaignParamsFromUrl on my application code, what happen is going on?**
Here is AndroidManifast xml code.
<receiver android:name="com.google.android.gms.analytics.CampaignTrackingReceiver"
android:enabled="true"
android:exported="true">
<intent-filter>
<action android:name="com.android.vending.INSTALL_REFERRER" />
</intent-filter>
</receiver>
<service android:name="com.google.android.gms.analytics.CampaignTrackingService"
android:enabled="true" />
<service android:name="com.google.android.gms.analytics.AnalyticsService"
android:enabled="true"
android:exported="false"/>
<receiver android:name="com.google.android.gms.analytics.AnalyticsReceiver"
android:enabled="true">
<intent-filter>
<action android:name="com.google.android.gms.analytics.ANALYTICS_DISPATCH" />
</intent-filter>
</receiver>
please answer anyone who has used Google Analytics Campaign successfully.
Thank you.
Is there a way how to start and android application after a boot automatically if it is on the /sdcard?
Ok, probably by BroadcastReceiver. But which action is the right one?
ACTION_BOOT_COMPLETED - does not work if it is on the /sdcard (documented)
ACTION_MEDIA_MOUNTED - does not work if it is on the /sdcard (which is undocumented)
ACTION_EXTERNAL_APPLICATIONS_AVAILABLE - does not work, I do not know why
ACTION_USER_PRESENT - does not work if the BroadcastReceiver is registered in AndroidManifest (which is undocumented, but documentation bug has been reported)
Thanks
Jan
try using <receiver android:name=".BootCompleteReceiver" >
<intent-filter>
<action android:name="android.intent.action.BOOT_COMPLETED" />
<action android:name="android.intent.action.QUICKBOOT_POWERON" />
</intent-filter>
</receiver>
and this <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
perhaps QUICKBOOT_POWERON help u
Please mention it in manifest file.
</uses-permission>
<receiver android:name=".BootReceiver"
android:enabled="true"
android:exported="true"
android:label="BootReceiver">
<intent-filter>
<action android:name="android.intent.action.BOOT_COMPLETED"></action>
</intent-filter>
</receiver>
provide permission "android.permission.RECEIVE_BOOT_COMPLETED" as child of menifest.
and one more thing your app must not be installed in sdcard.
According to Google, you should not put any app you want to run at boot on an external drive.
"The system delivers the ACTION_BOOT_COMPLETED broadcast before the external storage is mounted to the device. If your application is installed on the external storage, it can never receive this broadcast."
http://developer.android.com/guide/topics/data/install-location.html#ShouldNot
I usually register every intent filter for a broadcast receiver both ways (Android Manifest as well as dynamically in a class that extends Application)
In AndroidManifest.xml as:
<receiver
android:name=".broadcastReciever"
android:enabled="true"
android:exported="true" android:permission="android.permission.RECEIVE_BOOT_COMPLETED">
<intent-filter>
<action android:name="android.intent.action.BOOT_COMPLETED" />
<action android:name="android.intent.action.EXTERNAL_APPLICATIONS_AVAILABLE" />
</intent-filter>
</receiver>
and in a class that extends Application:
registerReceiver(new broadcastReciever(), new IntentFilter(Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE));
and don't forget to add RECEIVE_BOOT_COMPLETED permission and register the class which extends Application in the Android Manifest.
This should do; feel free to ask for any more help/clarification.