u/fproulxTrusted Contributorin r/netsec • Recommends
Android tap-jacking can be turned into ransomware
0:00 / 0:00
#cloak&dagger#androidsecurity#tapjacking
Cloak & Dagger: From Two Permissions to Complete Control of the UI Feedback Loop
Black Hat
281K subscribers • 47 videos on Hallway • Conference channel
- Recommended by 1 person: 1 in engineering communities.
- May be out of date. The tools, versions or practices it shows have likely moved on.
Advanced. Deep dive for people who know the field.
12K views9 years ago1 recommendation
SecurityMobile developmentExploits and vulnerabilitiesAndroid and Jetpack ComposeWeb and application security
Researchers demonstrate how combining two standard Android permissions allows attackers to silently control the UI and perform tap-jacking attacks.
While both the SYSTEM_ALERT_WINDOW and the BIND_ACCESSIBILITY_SERVICE Android permissions have been abused individually (e.g., in UI redressing attacks, accessibility attacks), previous attacks based on these permissions failed to completely control the UI feedback loop and thus either rely on vanishing side-channels to time the appearance of overlay UI, cannot respond properly to user input, or make the attacks literally visible. In this work, we demonstrate how combining the capabilities of these permissions leads to complete control of the UI feedback loop and creates devastating and stealthy attacks. by Chenxiong Qian, Simon Pak Ho Chung, Wenke Lee, & Yanick Fratantonio Full Abstract & Presentation Materials: blackhat.com/us-17/briefings.html#cloak-and-dagger-from-two-…Why it's here
1 person recommends thisWhat people say. Recommended as the definitive presentation on the Cloak and Dagger Android vulnerability.