3- Insecure Content Provider access

Durante el login:

public void postData(String valueIWantToSend) throws BadPaddingException, JSONException, NoSuchPaddingException, IllegalBlockSizeException, NoSuchAlgorithmException, IOException, InvalidKeyException, InvalidAlgorithmParameterException {
	HttpResponse responseBody;
	HttpClient httpclient = new DefaultHttpClient();
	HttpPost httppost = new HttpPost(DoLogin.this.protocol + DoLogin.this.serverip + ":" + DoLogin.this.serverport + "/login");
	HttpPost httppost2 = new HttpPost(DoLogin.this.protocol + DoLogin.this.serverip + ":" + DoLogin.this.serverport + "/devlogin");
	List<NameValuePair> nameValuePairs = new ArrayList<>(2);
	nameValuePairs.add(new BasicNameValuePair("username", DoLogin.this.username));
	nameValuePairs.add(new BasicNameValuePair("password", DoLogin.this.password));
	if (DoLogin.this.username.equals("devadmin")) {
		httppost2.setEntity(new UrlEncodedFormEntity(nameValuePairs));
		responseBody = httpclient.execute(httppost2);
	} else {
		httppost.setEntity(new UrlEncodedFormEntity(nameValuePairs));
		responseBody = httpclient.execute(httppost);
	}
	InputStream in = responseBody.getEntity().getContent();
	DoLogin.this.result = convertStreamToString(in);
	DoLogin.this.result = DoLogin.this.result.replace("\n", "");
	if (DoLogin.this.result != null) {
		if (DoLogin.this.result.indexOf("Correct Credentials") != -1) {
			Log.d("Successful Login:", ", account=" + DoLogin.this.username + ":" + DoLogin.this.password);
			saveCreds(DoLogin.this.username, DoLogin.this.password);
			trackUserLogins();
			Intent pL = new Intent(DoLogin.this.getApplicationContext(), (Class<?>) PostLogin.class);
			pL.putExtra("uname", DoLogin.this.username);
			DoLogin.this.startActivity(pL);
			return;
		}
		Intent xi = new Intent(DoLogin.this.getApplicationContext(), (Class<?>) WrongLogin.class);
		DoLogin.this.startActivity(xi);
	}
}

Se llama a trackUserLogins()

private void trackUserLogins() {
	DoLogin.this.runOnUiThread(new Runnable() { // from class: com.android.insecurebankv2.DoLogin.RequestTask.1
		@Override // java.lang.Runnable
		public void run() {
			ContentValues values = new ContentValues();
			values.put("name", DoLogin.this.username);
			DoLogin.this.getContentResolver().insert(TrackUserContentProvider.CONTENT_URI, values);
		}
	});
}

Que guarda los valores de los usuarios logueados en un Content Resolver que es como una base de datos.

La definición del content provider está en en TrackUserContentProvider.java

<provider
	android:name="com.android.insecurebankv2.TrackUserContentProvider"
	android:exported="true"
	android:authorities="com.android.insecurebankv2.TrackUserContentProvider"/>

Como android:exported="true" cualquier app instalada en el dispositivo puede hacer query, insert, update, delete sobre este provider sin ninguna autenticación. No hace falta ni root.

adb shell content query --uri content://com.android.insecurebankv2.TrackUserContentProvider/trackerusers