Formed in 2009, the Archive Team (not to be confused with the archive.org Archive-It Team) is a rogue archivist collective dedicated to saving copies of rapidly dying or deleted websites for the sake of history and digital heritage. The group is 100% composed of volunteers and interested parties, and has expanded into a large amount of related projects for saving online and digital history.
History is littered with hundreds of conflicts over the future of a community, group, location or business that were "resolved" when one of the parties stepped ahead and destroyed what was there. With the original point of contention destroyed, the debates would fall to the wayside. Archive Team believes that by duplicated condemned data, the conversation and debate can continue, as well as the richness and insight gained by keeping the materials. Our projects have ranged in size from a single volunteer downloading the data to a small-but-critical site, to over 100 volunteers stepping forward to acquire terabytes of user-created data to save for future generations.
The main site for Archive Team is at archiveteam.org and contains up to the date information on various projects, manifestos, plans and walkthroughs.
This collection contains the output of many Archive Team projects, both ongoing and completed. Thanks to the generous providing of disk space by the Internet Archive, multi-terabyte datasets can be made available, as well as in use by the Wayback Machine, providing a path back to lost websites and work.
Our collection has grown to the point of having sub-collections for the type of data we acquire. If you are seeking to browse the contents of these collections, the Wayback Machine is the best first stop. Otherwise, you are free to dig into the stacks to see what you may find.
The Archive Team Panic Downloads are full pulldowns of currently extant websites, meant to serve as emergency backups for needed sites that are in danger of closing, or which will be missed dearly if suddenly lost due to hard drive crashes or server failures.
CVE ID(s)
List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the GitHub Advisory Database.
Report
Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.
Android uses the IPC (Inter Process Communication) mechanism for communications among difference applications and different application components. The most common system functionality for IPC is Intent. Android allows a wide range of data types to be passed as intent extras.
Exported Android components including activities, services, receivers, and providers can be invoked by other applications on the same mobile device thus expose the attack surface. Android Activities, services, and receivers can be exposed in two ways:
android:exportedto trueandroid:exportedexplicitly set to falseThe second scenario is very important and issues in this category are very common in Android applications.
Also please note not all intent data passed between Android components impose security concerns - intent data passed between internal components of the same application, which cannot be controlled by attackers, shall not be treated as remote source. This helps to eliminate a large amount of false positives.
The related PR is #3812, which addresses the following two issues:
Android.qllandAndroidManifest.qllto handle the second scenario with intent filtersResult(s)
Provide at least one useful result found by your query, on some revision of a real project.
As the relevant PR enhances the core library, there is no accompanying query to run against real projects. Security researchers including myself can use the new remote source of Android intent extra as entry points to detect various security vulnerabilities in real Android projects. I will submit PRs for specific CWE vulnerability types in separate reports.