Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Mobile & Wireless

Most Android Devices Prone to Accessibility Clickjacking Attacks

Clickjacking attacks where users are tricked into enabling Android accessibility features are possible on a majority of devices, enterprise mobile security firm Skycure warned on Tuesday.

Clickjacking attacks where users are tricked into enabling Android accessibility features are possible on a majority of devices, enterprise mobile security firm Skycure warned on Tuesday.

The accessibility features offered by the Android operating system can be highly useful for people with impaired vision, hearing or motor skills. However, the Accessibility Service has also been abused by cybercriminals to steal sensitive information and install applications on devices.

Since the accessibility features are disabled by default, attackers need to find a way to convince victims to enable them in order for their malware to work. In many cases, they achieve this by displaying misleading pop-up messages that instruct users to manually enable Accessibility.

In March, researchers at Skycure demonstrated how attackers can enable accessibility features on Android devices by using clickjacking. Basically, attackers create a game that requires the user to click on certain points on the screen. While the user believes they are playing a game, they are actually navigating through Android’s options menu and enabling Accessibility.

Google is well aware of the threat posed by clickjacking attacks so it has added additional protections starting with Android 5.0 Lollipop. Specifically, the company ensured that system permission dialogs – such as the final confirmation “OK” button when activating Accessibility – cannot be covered by an overlay.

However, Skycure researchers discovered that this protection can be bypassed by making a hole in the overlay just on top of the OK button. In order to avoid raising suspicion, the hole does not include the “OK” text and instead it’s placed on top of a white portion of the button.

Skycure has made a video to show how clickjacking attacks can be used to trick users into enabling Accessibility on Android 5.x:

Advertisement. Scroll to continue reading.

 

Google has added further protections in the latest version of Android. In Android 6.x Marshmallow, users have to specifically allow an app to create a system overlay, which makes the attack significantly more difficult to pull off. Nevertheless, more than 95 percent of Android devices currently run versions prior to 6.0, which makes them vulnerable to accessibility clickjacking attacks.

Skycure informed Google about the issue in March, but the search giant has determined that the risk posed by this design flaw is low.

Android malware that leverages clickjacking is not unheard of. In late January, Symantec reported that the Android ransomware Lockdroid used clickjacking to gain administrator rights on infected devices.

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Mobile & Wireless

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

Mobile & Wireless

Samsung smartphone users warned about CVE-2023-21492, an ASLR bypass vulnerability exploited in the wild, likely by a spyware vendor.

Malware & Threats

Apple’s cat-and-mouse struggles with zero-day exploits on its flagship iOS platform is showing no signs of slowing down.

Fraud & Identity Theft

A team of researchers has demonstrated a new attack method that affects iPhone owners who use Apple Pay and Visa payment cards. The vulnerabilities...

Mobile & Wireless

Critical security flaws expose Samsung’s Exynos modems to “Internet-to-baseband remote code execution” attacks with no user interaction. Project Zero says an attacker only needs...

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Mobile & Wireless

Asus patched nine WiFi router security defects, including a highly critical 2018 vulnerability that exposes users to code execution attacks.