UIAutomator2 lets anyone on the network control/view your device!

I discovered something very concerning just now.

When using uiautomator2, which is what GramAddict is based around, it silently installs the application ATX-Agent on your device, which opens a webserver on TCP port 7912, that lets anyone on the network, with ZERO form of authentication, execute code, install apps, exfiltrate private data etc. on your device and view the screen remotely.

As soon as you’re running GramAddict, this webserver is started. This is a HUGE security concern, and should be addressed immediately!

Try it yourself:

1. Find the Wi-Fi IP address of your device: adb shell ip route | awk '{print $9}' (NOTE: It is trivial for anyone on the same network to discover your device and the running webserver)

2. Run GramAddict as ususal.

3. Using another device on the same network, go to http://[PHONE IP]:7912 in your browser.

This is what you’re presented with:

(censored for my privacy)

(Not showing the API page, as it exposes too much personal info. You can view its endpoints and capabilities at the ATX Agent page linked above)

This is extremely worrying!

[itsallmathematics]

I saw the help-wanted tag on this. I’m new to GramAddict and don’t know the codebase super well (nor have I programmed with UIAnimator2 before), but would be happy to help any way that I could. I mostly do software security development work & research.

[Prisscillia]

@itsallmathematics @narkopolo Just a heads up I was planning on forking this repo and reading through the code base in an attempt at the same thing. Hopefully we can get this fixed together