Unprivileged applications can retrieve the ICCID
The phone system service did not properly enforce permissions on its getPhoneAccountHandleForSubscriptionId method.
When called by an unprivileged application, the parceled response contained the ICCID number (Integrated Circuit Card Identifier), a 20-digit number that uniquely identifies a SIM card.
Such identifier should not be accessible to unprivileged applications due to the privacy implications that unique, tied to the SIM card, identifiers have.
The PhoneAccountHandle include ICCID
Test: adb shell run-as <unprivileged_app> service call phone 153
Bug: https://partnerissuetracker.corp.google.com/issues/161860604
Signed-off-by: duki.hong <duki.hong@samsung.com>
Change-Id: Id3b155a9cf4a4fbf3dc326de50f978a12bd5f6cd
1 file changed