Hacking Android Foreground Services Escalation Of Privileges by Rony Das | Nullcon Goa 2022

### Overview In this talk presented at Nullcon Goa 2022, Rony Das demonstrates a privilege escalation bypass affecting Android foreground services. Das explores how background execution limits introduced in Android 8 (Oreo) mandate sticky foreground notifications whenever applications access sensitive hardware components like the microphone, camera, or GPS. While prior bypasses (notably patched under CVE-2019-2219) attempted to briefly initiate services and stop notifications, Das demonstrates a new threading technique that offloads media recording calls to a separate thread, enabling continuous covert audio recording up to Android 10 without leaving a persistent user notification.

### Key Topics - **Android Foreground Service Limits**: Android 8 Oreo introduced restrictions preventing background applications from accessing sensitive hardware sensors (microphone, camera, GPS) without an active, non-dismissible foreground notification. - **The 5-Second Window**: Once `startForegroundService()` is invoked, developers have a strict 5-second window to post a foreground notification, otherwise the Android operating system kills the service. - **Historical Vulnerability (CVE-2019-2219)**: An earlier technique allowed apps to start a foreground service, hand off audio recording to the Android Media API, and stop the notification. Google addressed this issue with a December 2019 patch. - **Threading Bypass**: Das discovered that by dispatching audio capture to a background `Runnable`/thread, the main thread can invoke `stopForeground()` almost immediately (within 2–3 seconds), avoiding the persistent sticky notification while audio recording continues unobtrusively.

### Technical Details In Android's security model, hardware sensors are governed by strict application context and service restrictions. Long-running background spyware needs persistence without visual indicators. Under the documented architecture, calling Android's built-in `Android Media API` delegates recording tasks to Android's media server context, which writes output directly to internal cache storage without requiring custom low-level sensor implementation.

Under CVE-2019-2219, Google patched direct sequential calls because completing the operation inline took too long or failed under updated OS checks. In Das's updated zero-day technique: 1. The malicious service invokes `startForegroundService()`. 2. Immediately, execution dispatches a new thread (`Runnable`) tasked with calling `startRecording()` via the Android Media API for a prolonged duration (e.g., 2 minutes). 3. Because the recording logic runs asynchronously on another thread, the main execution thread immediately calls the stop foreground notification method well within the 5-second deadline (typically within 2 to 3 seconds). 4. The foreground notification disappears almost instantaneously, yet the underlying media server continues recording audio into the application's cache directory.

During a live demo on a physical Android 10 device, Das compared the patched technique against the new threading approach. The demonstration verified that despite no visible notification appearing in the status bar, newly written audio files continuously grew in size within the app's cache directory.

### Takeaways Das noted that Google resolved the underlying issue in Android 11. However, for Android 10, Google indicated they would not backport a fix due to extensive infrastructure changes required in the operating system. Because Android 10 remained unpatched for this specific flaw, no CVE was assigned for this variant.