Android WebView Vulnerability (Android 4.1 or older) - Hacker can install malicious software, send SMSs by javascript code.

Android WebView Vulnerability  - Android 4.1 or older

AVG Security expert reported a critical vulnerability in Android's WebView feature that allows an attacker to install malicious software, send SMSs and performing more tasks.
Android WebView - A View that displays web pages, allows the user to view a web page as a part of an ordinary Android application.The WebView class is an extension of Android’s View class that allows you to display web pages as a part of the appication’s screen layout. It uses the WebKit rendering engine to display web pages and includes methods to navigate forward and backward through a history, zoom in and out, perform text searches etc. . It does not include any features of a fully developed web browser.if the web page you plan to load in your WebView uses JavaScript, you must enable JavaScript for your WebView.Once JavaScript is enabled, you can create interfaces between your application code and your JavaScript code.

addJavascriptInterface (Object object, String name) method

  The addJavascriptInterface method injects a supplied Java object into WebView. The object is injected into the JavaScript context of the main frame, using a supplied name and this allows the Java object’s methods to be accessed from JavaScript. For applications running Android 4.1 or older, all public methods (including the inherited ones) can be accessed, so when a user’s installed application with addJavascriptInterface method loads an external webpage it can use WebView and javascript to call a java object (like a ‘Javascript pipeline’ and usage of reflection to invoke any other unregistered Java class) which allows attackers to call Android’s Java methods.

 The fix: 

 For applications running Android 4.2 all public methods that are annotated with JavascriptInterface can be accessed from JavaScript. So if you develop an application for SDK version 17 or higher, you must add the @JavascriptInterface annotation to any method that you want available to your JavaScript. If you do not provide the annotation, the method is not accessible by your web page when running on Android 4.2 or higher. What you should do? As developers you should not assign unsafe functions. As users you should try not to download suspicious mobile applications from third party markets and avoid clicking on suspicious links coming from strangers.

 Infection method:

 Users can be infected when they click on a URL link using a vulnerable application that allows opening a Java enabled browser or web page. The device will automatically perform the malicious actions that were ordered in the malicious web page that contain those JavaScript commands. The commands in the JavaScript code can enable attackers to install malicious software, send SMSs, steal personal information and more.

courtesy avg blog