Clickjacking attacks where users are tricked into enabling Android accessibility features are possible on a majority of devices, enterprise mobile security firm Skycure warned on Tuesday.
The accessibility features offered by the Android operating system can be highly useful for people with impaired vision, hearing or motor skills. However, the Accessibility Service has also been abused by cybercriminals to steal sensitive information and install applications on devices.
Since the accessibility features are disabled by default, attackers need to find a way to convince victims to enable them in order for their malware to work. In many cases, they achieve this by displaying misleading pop-up messages that instruct users to manually enable Accessibility.
In March, researchers at Skycure demonstrated how attackers can enable accessibility features on Android devices by using clickjacking. Basically, attackers create a game that requires the user to click on certain points on the screen. While the user believes they are playing a game, they are actually navigating through Android’s options menu and enabling Accessibility.
Google is well aware of the threat posed by clickjacking attacks so it has added additional protections starting with Android 5.0 Lollipop. Specifically, the company ensured that system permission dialogs – such as the final confirmation “OK” button when activating Accessibility – cannot be covered by an overlay.
However, Skycure researchers discovered that this protection can be bypassed by making a hole in the overlay just on top of the OK button. In order to avoid raising suspicion, the hole does not include the “OK” text and instead it’s placed on top of a white portion of the button.
Skycure has made a video to show how clickjacking attacks can be used to trick users into enabling Accessibility on Android 5.x:
Google has added further protections in the latest version of Android. In Android 6.x Marshmallow, users have to specifically allow an app to create a system overlay, which makes the attack significantly more difficult to pull off. Nevertheless, more than 95 percent of Android devices currently run versions prior to 6.0, which makes them vulnerable to accessibility clickjacking attacks.
Skycure informed Google about the issue in March, but the search giant has determined that the risk posed by this design flaw is low.
Android malware that leverages clickjacking is not unheard of. In late January, Symantec reported that the Android ransomware Lockdroid used clickjacking to gain administrator rights on infected devices.