what does the intent filter verification service app from Google do?

Question

While updating apps on Fdroid (not sure which one because is was bulk update, could be any from Activity Diary, Editor, Simple Calendar), the firewall (AFWall+, moto x 2nd gen rooted) caught an attempt to communicate with what a whois search identified as amazon servers. The app that tried to communicate was Google's Intent Filter Verification Service. Does anyone know what is this app for? I am not asking what Intent Filters are....

Answer 1

I used APKTool to find the following details:

1. It is not a Framework or a Shared Library,
2. It does not get backed up,
3. It appears to use some custom permissions (INTENT_FILTER_VERIFICATION_AGENT, BIND_INTENT_FILTER_VERIFIER, INTENT_FILTER_NEEDS_VERIFICATION)
4. It has a Broadcast Receiver, so presumably this NEEDS VERIFICATION stuff is happening at an OS level,
5. It is a Service.

I tried reading the reversed code, but I have no experience with Smali and therefore didn't make much meaningful progress. Next, I used AndroGuard to make a Call Graph:

androcg.py --output intent-filter.gml --no-isolated Intent\ Filter\ Verification\ Service_com.android.statementservice.apk

... then I turned this into an image:

import networkx as nx
import matplotlib.pyplot as plt
ifv = nx.read_gml('intent-filter.gml')
# filter out some system stuff, I think
ifv = ifv.subgraph([a for a in ifv.nodes() if not 'Landroid' in a])
# filter out some java utility type stuff, I think
ifv = ifv.subgraph([a for a in ifv.nodes() if not 'Ljava/lang' in a])
isolates = nx.isolates(ifv)
nonisolates = list(set(ifv.nodes()) - set(isolates))
ifv = ifv.subgraph(nonisolates)
relabeler = {key: key.split()[0].split('/')[-1] for key in ifv.nodes()}
ifvn = nx.relabel_nodes(ifv, relabeler)
ifvn.remove_edges_from(nx.selfloop_edges(ifvn))
nx.draw(ifvn, with_labels=True)
fig = plt.gcf()
fig.set_size_inches(18, 10)
fig.savefig('intent-filter.jpg',dpi=200)

I get this:

My suspicion from the name of the service is that it effectively takes an Intent and determines whether or not that Intent satisfies the (grammar? of the ...) Intent Filter of each publicly declared exportable component in each Manifest.xml for all the apps on the device. This call graph seems to sort of support my hypothesis. In particular, URL is dead center with a ton of out-going edges, the nodes in the middle-ring of stuff kind of look like verification or filtration of some sort (parsing an extended message nano, looking at a network response, pulling the data from the Intent, getting a web port, checking if a protocol is valid or invalid ...), and finally the very outer-most items that have only incoming edges kind of seem like they are either executing the Intent by passing it to a destination (e.g, HttpURLConnection ->, NetworkResponse, AndroidAppAsset, ...), or discarding it as invalid (InvalidProtocolBufferNanoException, ResistanceFollowRedirects, OutOfSpaceException, ...).

I am just an amateur sleuth and cannot claim to really know what all this means, but this is my 10 cents. I think that the the Service forms the connection between an invoked Intent and all of the IntentFilters in apps on the device. I think it decides what goes to which app, if something has invalid data like in a null fuzzing scenario, and if something should go to the web. I think it also stops some sort of infinite-redirect attack. I suspect this is an effort on the part of the Android dev team to defend against inter-component communication (ICC) attacks and app link / URI vulnerabilities. Hope this helps!

Answer 2

I think this is a "watcher" program, or a language-interpretation program. It might be how the MMS services "guess" the next word you are going to use during texting, and offer it's three best guesses as suggestions.

To stretch it's use further, this program is probably also the one that ferries every fifth text or phone call to the FBI/CIA to "watch" all of us as potential "terrorists". x(