All unpatched Android phones that are running a version that’s older than Oreo will be needing a fairly patching soon, with researchers turning up a class of vulnerability that allows malware draw fake dialogs so users “okay” their own pwnage.
The risk, according to Palo Alto Networks’ researchers, comes from what’s known as an overlay attack.
It’s a straightforward way to trick users: draw a bogus screen for users to click on (for example, to install an app or accept a set of permissions), hiding what’s really happening.
Apart from running an Android Oreo, Android itself is supposed to prevent this happening. As the authors write, “everyone has believed that malicious apps attempting to carry out overlay attacks must overcome two significant hurdles to be successful:
- They must explicitly request the “draw on top” permission from the user when installed;
- They must be installed from Google Play.
The vulnerability turned up by Palo Alto’s Unit 42 threat research team bypasses these requirements, by exploiting a notification type called Toast that Android documentation describes as “a view containing a quick little message for the user.
If you ain’t running an Adroid Oreo The Palo Alto discovery builds on a paper published by the IEEE (PDF) that showed the permissions granted by the SYSTEM ALERT WINDOW and the BIND ACCESSIBILITY SERVICE. These, Yanick Fratantonio and fellow-researchers Chenxiong Qian, Simon Chung and Wenke Lee showed, can be exploited to “successfully and completely compromise the UI feedback loop”.
Exploiting these permissions, the paper explains, “allows an attacker to both modify what user sees and inject fake input, all while maintaining the expected ‘user experience’ and remaining stealthy”.
Palo Alto’s people say the overlay attack they’ve discovered “could carry out an overlay attack simply by being installed on the device” especially if you ain’t using an Android Oreo.