Android Security Hole Grows

• By Sydny Shepard
• May 18, 2016

In March, security researchers at Skycure discovered a theoretical attack that involves the exploitation of two Android features that can be used together to take complete control over a victims phone or tablet. Now, those same researchers believe they’ve found event more ways to exploit more versions of the Android OS.

In March, Skycure said they believed 66 percent of Android phones and tablets could be hacked; now the number has been increased to 95.4 percent, or 1.34 billion devices.

By using an Accessibility Clickjacking Exploit, the researchers were able to leverage Android feature “Accessibility Service” along with a second feature built into the Android OS that allows you to draw over other apps. According to the security firm, all versions of the Android OS that came before 6.x Marshmallow are vulnerable to this clickjacking hack.

In order to tap into the vulnerability, a hacker would create a game or application that would run in an overlay window on top of the Android home screen. While the app was running, it would open up the Accessibility Services settings. The game would trick the user into tapping areas of the overlay screen that would also be recognized in the underlying screen. Using this method, an attacker could also trick you into tapping the right sequence of settings to hand over control of your phone to a remote hacker.

This clickjacking method could allow the hacker to invisibly open and close settings and open malicious webpages that can install malicious software onto the phone or tablet. Skycure says this technique could also trick users into unknowingly approve the service’s permissions such as Device Administrator access.

“After presenting this research at RSA, confirmed on all Android versions through KitKat, it occurred to me that there may be a way to also run this on Android devices running Lollipop. My team was then able to test this and verify that Lollipop is also vulnerable to Accessibility Clickjacking,” Yair Amit, CTO and co-founder of Skycure, said in a blog post.

Google has acknowledged the vulnerabilities brought forward by Skycure calling it, “an example of nefarious use of genuine tech.” Google has turned off, by default, the overlay feature in the Android 6.x OS. Users who want to take advantage of overlay screens in Android 6.x and above will have to opt-in to the feature.