3 ms·
Did some investigation. So when you click on "Manage my account" you actually get taken out of the settings app and into an Activity (name for the "screen" God
by flutas 3y ago
Did some investigation.
So when you click on "Manage my account" you actually get taken out of the settings app and into an Activity (name for the "screen" God object on Android) embedded inside of Google Play Services. Eventually, following this the browser is
com.google.android.gms/.auth.folsom.ui.GenericActivity.
This doesn't seem to be using the default system webview implementation, as on my phone that would be Chrome.
Android allows you to build a JS interface between Android code and Javascript code using addJavascriptInterface[0]. They seem to be doing this...a lot in GMS, which is an interesting attack vector to look into later.
Our suspect "mm" interface is in MagicArchChallengeView. Which gets you an obfuscated "bwuz" class as what mm links to. bwuz seems to be pretty empty though, again linking out to a few obfuscated classes.
Doing a straight string search two classes expose these functions, "qvc" and "pdn". pdn seems like the meat, while qvc has some helpful error logs exposing what each param is.
Looks like setVaultSharedKeys expects a gaiaId (Google Accounts and ID Administration ID), and a JSON array of JSON objects with two values, epoch and key. It creates an arraylist of them and passes them off to an abstract class that is everywhere in the package, but seems to be really involved with account security.
addEncryptionRecoveryMethod expects a gaiaId, a security domain list, and a member public key. It again packages them into lists and passes them off to the same abstract class mentioned above.
That's where I drop off because I have to get to work. Interesting though and warrants further exploration, both on this specific interface but also the others they expose through GMS into webviews.
[0]: https://developer.android.com/reference/android/webkit/WebView.html#addJavascriptInterface https://developer.android.com/reference/android/webkit/WebVi...
- kitsunesoba 3y agoI wonder why they’re not using the system default webview… Does this mean it’s WebKit instead of Blink? If it is Blink, it seems likely that it’s not as up to date as the one provided by Chrome. EDIT: just noticed the docs link, yeah it’s WebKit.
- deleted 3y ago[deleted]
- esprehn 3y agoIt's not actually WebKit, that's just a package name that was poorly chosen a decade ago. https://developer.android.com/develop/ui/views/layout/webapps/managing-webview https://developer.android.com/develop/ui/views/layout/webapp... It's the system WebView, it's just not using Custom Tabs. https://developer.chrome.com/docs/android/custom-tabs/ https://developer.chrome.com/docs/android/custom-tabs/
- flutas 3y agoAh, my bad! I was confusing WebView with custom tabs, sorry about that! Been a while since I've needed either for anything.
- youngtaff 3y agoAlex Russell talked about Android's WebView not being Chrome at State of the Browser in 2021 https://2021.stateofthebrowser.com/speakers/alex-russell/ https://2021.stateofthebrowser.com/speakers/alex-russell/
- kinlan 3y agoHuh. Where did he say that? WebView is Chromium and it's updated alongside Chrome updates. There are differences because of the process model in apps and some APIs aren't available... https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/docs/faq.md#:~:text=on%20your%20phone.-,What's%20the%20relationship%20between%20WebView%20and%20Chrome%3F,WebView%20is%20built%20into%20Chrome https://chromium.googlesource.com/chromium/src/+/HEAD/androi....
- kbenson 3y ago> gaiaId (Google Accounts and ID Administration ID) Wow, someone at Google is undoubtedly proud of coming up with that for what I assume is essentially a Google world wide unique ID, and for good reason.
- inanutshellus 3y agoReminds me of the "Agents of S.H.I.E.L.D." scene where someone quips "Sounds like someone just really wanted it to spell 'shield'."
- fsckboy 3y agohttps://www.youtube.com/watch?v=zqXhD_4CKc8 https://www.youtube.com/watch?v=zqXhD_4CKc8