Cloak & Dagger is a new class of potential attacks affecting Android devices. These attacks allow a malicious app to completely control the UI feedback loop and take over the device — without giving the user a chance to notice the malicious activity.
Security experts from Palo Alto Networks discovered a vulnerability with Android overlay system which allows an attack by Toast type Overlay. Every android devices less than 8.0 are vulnerable to this attack.
Overlay attacks allow an attacker to draw on top of other windows and apps running on the affected device. With this recently found overlay assault does not require a particular permissions or conditions to be compelling. Malware propelling this assault does not have to have the overlay consent or to be introduced from Google Play.
Also Read Millions of Android Phones including latest Versions Vulnerable
With these permissions are in all actuality, various effective assaults can be propelled on the device, including taking credentials, introducing applications silently, and locking the device for the payment.
Cloak and Dagger work by adjusting locales of the screen to change what the victim sees, deceiving them into empowering further permissions or recognizing their input data sources.CVE-2017-0752 was assigned for this vulnerability and it was fixed with security patch released on 2017-09-01, with the fix for a subset of vulnerabilities that are similar across all Android devices.
Vulnerability on Android OS
Experts say Toast overlay is normally used to show a rapid message over all different applications. For instance, a message showing that an email has been spared as the draft when a client explores away without sending an email.
It normally acquires all configuration options with respect to different windows sorts. Be that as it may, our examination has discovered utilizing the Toast window as an overlay window permits an application to compose over the interface of another App without asking for the SYSTEM_ALERT_WINDOW benefit this ordinarily requires.
Vulnerability occurs due to lack of permission checks in code validation with Android AOSP (version <= 7.0) and with Android OS version 7.1 it has multiple layers of mitigation, First layer forcibly due to lack maximum timeout and second mitigation, Android 7.1 allows only one Toast window per app to be shown at a time.
Through the overlay attack, an installed malicious app can fool the user into giving the app Device Administrator permissions. With this, it will have the capability to launch deadly attacks, including:
- Locking the device screen
- Resetting the device PIN
- Wiping the device’s data
- Preventing the user from uninstalling the App
Google patched and disclosed this vulnerability on September 5th of 2017.
