Write-up

CVE-2023-35671

7 min read Tiziano Marra

Android App Pin security issue exposes payment cards in Google Wallet to unauthorized payments.

Table of Contents

What is Android App Pinning?

Android app pinning, initially known as ‘screen pinning’, was introduced with Android 5.0 Lollipop (API level 21), released on November 12, 2014. This robust security mechanism enhances user control, privacy, and data security on Android devices.

App pinning empowers users to confine their device to a single app, effectively limiting access to other applications and sensitive information. This functionality proved invaluable in scenarios where sharing a device, interacting with public terminals, or maintaining a highly focused work environment was essential. By doing so, it prevents unauthorized access to personal data, applications, and settings, contributing to an overall more secure digital experience.

The process of utilizing app pinning typically involves the following steps:

  1. Enabling App Pinning: Users can activate this feature through their device settings (Settings –> Security & privacy –> More security settings –> App pinning). Once enabled, they can select the app they wish to pin.
  2. Entering Pinned Mode: Upon launching the desired app, users initiate the pinning process. This action locks the device into the selected app’s interface.
  3. Restricted App Interaction: While in pinned mode, all other apps become temporarily inaccessible. Attempts to switch to another app, access notifications, or perform other functions will prompt the device to remain within the pinned app.
  4. Exiting Pinned Mode: To exit this mode, users typically need to provide an additional layer of authentication, such as entering a pre-set PIN, pattern, password, or using biometric recognition (like fingerprints or facial recognition). This extra layer ensures that only authorized users can leave the pinned app environment.

Benefits of Android app pinning include:

  • Privacy and Security: Pinned mode prevents unauthorized access to personal data, sensitive applications, and confidential information.
  • Public Terminals: App pinning proves useful in situations like kiosks or shared devices, as it restricts users to a specific application, minimizing the risk of unauthorized access and data exposure.
  • Focus and Productivity: Users can create focused work environments by limiting their device’s capabilities to a single task-oriented application.
  • Parental Controls: Parents can utilize app pinning to restrict their children’s device usage to specific educational or age-appropriate apps.

In summary, Android app pinning, previously known as ‘screen pinning’, was introduced with Android 5.0 Lollipop and provides granular control over device functionality and access. By designating a specific app for use and requiring authentication to exit that mode, it offers enhanced security, privacy, and focused engagement with digital content.

About the issue

In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read the full card number and expiry details when the device is in locked screen mode due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.REF

Google has calculated a high severity for this vulnerability.

Getting Started

Through the following PoC you can test this vulnerability on your Android smartphone.

Prerequisites

  • Android smartphone;

  • App Pinning functionality, with the option Ask for PIN before unpinning, must be enabled in system settings;

    Android App pinning settings with 'Ask for PIN before unpinning' toggle enabled

  • At least one payment card configured in Google Wallet;

    Google Wallet home screen with an N26 Mastercard debit card added

  • An NFC reader for payment cards, e.g. Flipper Zero.

    Flipper Zero multi-tool device with the dolphin mascot on its display

  • NFC, with the option Require device unlock for NFC, must be enabled on the smartphone.

    Android NFC settings with 'Require device unlock for NFC' toggle enabled

Proof of Concept

A Google Pixel 7 Pro running Android 13 was used for this PoC; all builds released before September 2023 are vulnerable:

Android About phone screen showing Model: Pixel 7 Pro and Android version 13 Android About phone screen showing Build number TQ3A.230805.001

Full PoC video

YouTube thumbnail for the CVE-2023-35671 PoC video: a Flipper Zero reading an N26 card from a Pixel 7 Pro

PoC step-by-step using screenshots

  1. Open any app; in this PoC the Brave browser app was chosen:

    Brave browser displaying the github.com/MrTiz profile page before pinning

  2. Pin the app:

    Android Recents overview with a red arrow highlighting the Brave app card Android app-overview long-press menu on Brave with the 'Pin' option highlighted

    Android 'App is pinned' confirmation dialog explaining swipe-up-and-hold to unpin Brave browser with an 'App pinned' toast notification confirming pinning succeeded

  3. Now unpin the app by performing the same action (Swipe up & hold) you would perform if you wanted to view the “Recents screen” list; the Android lock screen will open, prompting you to unlock the device via one of the enabled lock methods:

    Android lock screen shown after the unpin attempt, with the Wallet shortcut visible in the bottom-right corner

  4. You can now use the Flipper Zero device to read the payment card data registered in Google Wallet:

    Animated proof of concept: the Flipper Zero reads NFC card data from the locked Pixel 7 Pro through Google Wallet

    Google Wallet showing a 'Phone moved too fast' error triggered by the Flipper Zero NFC read Google Wallet contactless payment prompt appearing on the locked device: 'Hold this part of your phone to the terminal until you see a check mark'

    Flipper Zero display showing the leaked Mastercard debit card details read via NFC: card number, expiration, currency EUR, region ITA

N.B. if a real P.O.S. (Point Of Sale) had been used instead of the Flipper Zero, the smartphone would have made an unauthorized payment because the smartphone was not unlocked (the Require device unlock for NFC option is enabled).

Documentation

Authors

Disclaimer

The author of that PoC (Proof of Concept) and discoverer of the vulnerability would like to clarify that all information provided in this repository is for educational and research purposes only. The author does not endorse or support the use of this information for illegal or malicious purposes in any way. The author assumes no responsibility for any unlawful use that may arise from the knowledge of this vulnerability or the use of the PoC.

Furthermore, the author disclaims any liability for any damage caused to devices, systems, or data involved in the implementation of the PoC or resulting from the application of suggested fixes or mitigation measures. Users who choose to utilize the information contained in this repository do so at their own risk, assuming full responsibility for the consequences of their actions.

It is strongly advised to use the information provided here in a controlled environment and only with explicit consent from the owners of the systems in question.

The author is committed to positively contribute to the security of information technology and encourages all users to abide by applicable laws and regulations, as well as to conduct ethical research and disclosure of vulnerabilities.