Services

📌What are Android Services?

• An Android Service is a component that runs in the background, independent of the UI, to perform long-running operations without requiring user interaction.

• Services are used to perform tasks that might need to continue even when the app is not actively in the foreground.

• The downside of these services is that we can't update the UI because the service runs in the background and has no connection to the main UI thread.

📍Services are used for various purposes such as:

• Playing music in the background.

• Fetching data from a server.

• Performing network operations.

• Handling background tasks like syncing data.

• Monitoring device sensors.

• Performing periodic tasks.

📍Defining and Invoking Services

• Services are defined in the AndroidManifest.xml file to let the system know about them.

• To define a service, you create a class that extends the Service class and override its methods (onCreate, onStartCommand, onBind, onDestroy) to define the behavior of the service.

• To invoke a service, you typically use an Intent to start or bind to it. The startService() method starts a service, while the bindService() method binds to the service to allow interaction between components.

📌Service types

1) Start Service

• A startService() is a service that starts, runs, and then shuts down, without interaction with other components.

• Definition

  public class MyService extends Service {
      @Override
      public int onStartCommand(Intent intent, int flags, int startId) {
          // Your code to handle the service start command
          return START_STICKY; // Example return value
      }
  }

  • onStartCommand method:

    • It is a method that you can override when you create a service that extends the Service class.

    • It's used to handle commands that are sent to the service when it's started using the startService() method. The method returns an integer value that indicates how the service should behave.

    

2) Bound Services

• A bound service is a service that allows clients (usually an Activity) to establish a connection with it. This connection enables components to interact directly with the service, invoking methods and exchanging data through its interface.

• We have to wait for all the clients to unbound from the service to shut down.

• Bind service uses messages

To attack a service, it must be exported and you must have permission to use it.

📌Hacking Android Services

• Testing

  1. Check AndroidManifest.xml for android:exported="true".

  2. Review service methods for sensitive actions triggered by incoming intents.

  3. Example AndroidManifest.xml:

     <service android:exported="true" android:name=".SensitiveService" />

• Exploit

  • ADB Commands

    am startservice -n <package>/<service-name>
    am startservice -n com.example.app/.SensitiveService

---