My Other ClassLoader is Your ClassLoader Reloaded: Reviving Parcelable Objects
summary
Shows how a malicious app with no permissions can intercept an Intent, extract a Parcelable, write it to disk, edit a field (for example the URL or user token) and revive it so the victim app processes the modified object; demo uses a Frida hook to redirect startActivity, Parcel.obtain(), marshall/unmarshall, and createPackageContext to get the target ClassLoader; highlights a real “monster” class with 46 fields (≈90 nested) and the proof‑of‑concept works.
AI-written summary · about
chapters (16)
- 0:00Introduction and speaker intro
- 1:07Talk outline and context
- 2:08Class loaders theory basics
- 3:55Serialization and Parcelables in Android
- 5:17Known vulnerabilities in serialization
- 7:23Misconception about app sandboxing
- 8:46Previous exploitation techniques overview
- 12:38Parcelables in Android communication
- 13:20Limitations of prior techniques
- 15:04New exploitation technique concept
- 18:38Target app vulnerability setup
- 21:15Vulnerability explanation and demo intro
- 22:16Live demo walkthrough
- 25:03Demo results and impact
- 26:18Takeaways and developer misconceptions
- 28:08Malware research and call to action
related talks
39mAndroid Parcels: The Bad, the Good and the Better - Introducing Android's Safer Parcel
32mBreaking the Android ClassLoader
33mBreaking the Android ClassLoader
35mHey, Your Parcel Looks Bad - Fuzzing and Exploiting Parcel -Ization Vulnerabilties in Android
34mDeserialization: what, how and why [not]
47mAttacking Android Applications
48mA Novel Runtime Technique For Identifying Malicious Applications
40mDon’t let attackers exploit your app via Intents