Skip to content
attack.paths
Connexion
← RegistryDossier · 6 steps · 5 edges

Exported ContentProvider → private data leak

App exports a ContentProvider for legitimate inter-app integration but forgets to enforce grantUri / signature permissions — a rogue installed app reads private auth tokens.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: a malicious app is installed alongside the target (via Play Store with overly-permissive permissions or a sideload). Target's manifest has android:exported='true' on a sensitive provider.

§ Steps

  1. 01
    Exfil tokens / PIIExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Build / install rogue companion appInitial Access
    T1078— Valid Accounts
  3. 03
    Query the provider URICredential Access
    T1552— Unsecured Credentials
  4. 04
    Check readPermission / writePermission attrsDiscovery
    T1083— File and Directory Discovery
  5. 05
    Spot exported ContentProviderCollection
    MOB-CONTENT-PROVIDER— Content Provider Data Leak
  6. 06
    Reverse target APKReconnaissance
    MOB-APK-REVERSE— APK Reverse Engineering

§ References

§ Frequently asked

What is the "Exported ContentProvider → private data leak" attack path?
App exports a ContentProvider for legitimate inter-app integration but forgets to enforce grantUri / signature permissions — a rogue installed app reads private auth tokens. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Exfil tokens / PII (T1041) — a exfiltration primitive. Assumed environment: a malicious app is installed alongside the target (via Play Store with overly-permissive permissions or a sideload).
What is the final impact of this kill-chain?
The final step lands on Reverse target APK (MOB-APK-REVERSE), which falls under Reconnaissance. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers