Everybody without Android Oreo vulnerable to overlay attack
Any unpatched Android phone running a version older than Oreo is going to need patching fairly soon, with researchers turning up a class of vulnerability that lets malware draw fake dialogs so users “okay” their own pwnage.
The risk, according to Palo Alto Networks’ researchers, comes from what’s known as an overlay attack.
It’s a straightforward way to trick users: draw a bogus screen for users to click on (for example, to install an app or accept a set of permissions), hiding what’s really happening.
Android is supposed to prevent this happening. As the authors write, “everyone has believed that malicious apps attempting to carry out overlay attacks must overcome two significant hurdles to be successful:
The vulnerability turned up by Palo Alto’s Unit 42 threat research team bypasses these requirements, by exploiting a notification type called Toast that Android documentation describes as “a view containing a quick little message for the user.
Palo Alto’s demonstration of an overlay attack: the bogus dialog tricks the user
The Palo Alto discovery builds on a paper published by the IEEE (PDF) that showed the permissions granted by the SYSTEM ALERT WINDOW and the BIND ACCESSIBILITY SERVICE. These, Yanick Fratantonio and fellow-researchers Chenxiong Qian, Simon Chung and Wenke Lee showed, can be exploited to “successfully and completely compromise the UI feedback loop”.
Exploiting these permissions, the paper explains, “allows an attacker to both modify what user sees and inject fake input, all while maintaining the expected ‘user experience’ and remaining stealthy”.
Palo Alto’s people say the overlay attack they’ve discovered “could carry out an overlay attack simply by being installed on the device”. ®
Sponsored:
The Joy and Pain of Buying IT – Have Your Say
Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/09/11/everybody_without_android_oreo_vulnerable_to_overlay_attack/