Bridge Attack: Double-Edged Sword in MobileSec

Architecture and Background

Bridge Attack(BA) is new attack surface for mobile phone and IoT devices in LAN. The abstract bridge is usually implemented by some custom schemes or protocols, such as Javascript Bridge in webview, Upnp Protocol in IoT.

Vulnerability Analysis

In some cases, the Bridge's expanded ability makes the risks of devices in LAN, and the vulnerability can be persistently exploited with a common web attack（Eg. XSS/CSRF) Bridge Attack finds the potential vulnerability in communication between internal and external components.

Exploitation and Demonstrations

We think that external component gives more data-flow attack entries which should be checked identification in the internal component. That means bridge attack makes devices in LAN face more attack risks which can lead to remote code execution, sensitive data leak and IOT devices being controlled.

Remediation and Defensive Strategies

Zidong Han, is an android security researcher from Tencent Mobile Security Lab, Razor Team. Focuses on mobile security research, especially App vulnerability and IOT related security research, Attended HITB-SECCONF-2018-Beijing,as a speaker in CommSec:《Who Hijacked My Smart Home: One URL to Hack ALL IoT Devices 》Attended GeekPwn 2018, Hack Pwn in House. Found and exploited more than 20 vulnerabilities in eight kinds of IoT devices. WeChat: hzddm12340