Tuesday, May 28, 2024

Beware!! All Android Versions Up to 7.0 are Vulnerable to Toast Overlay Attack

Cloak & Dagger is a new class of potential attacks affecting Android devices. These attacks allow a malicious app to completely control the UI feedback loop and take over the device — without giving the user a chance to notice the malicious activity.

Security experts from Palo Alto Networks discovered a vulnerability with Android overlay system which allows an attack by Toast type Overlay. Every android devices less than 8.0 are vulnerable to this attack.

Overlay attacks allow an attacker to draw on top of other windows and apps running on the affected device. With this recently found overlay assault does not require a particular permissions or conditions to be compelling. Malware propelling this assault does not have to have the overlay consent or to be introduced from Google Play.

Also Read Millions of Android Phones including latest Versions Vulnerable

With these permissions are in all actuality, various effective assaults can be propelled on the device, including taking credentials, introducing applications silently, and locking the device for the payment.

Cloak and Dagger work by adjusting locales of the screen to change what the victim sees, deceiving them into empowering further permissions or recognizing their input data sources.CVE-2017-0752 was assigned for this vulnerability and it was fixed with security patch released on 2017-09-01, with the fix for a subset of vulnerabilities that are similar across all Android devices.

Vulnerability on Android OS

Experts say Toast overlay is normally used to show a rapid message over all different applications. For instance, a message showing that an email has been spared as the draft when a client explores away without sending an email.

It normally acquires all configuration options with respect to different windows sorts. Be that as it may, our examination has discovered utilizing the Toast window as an overlay window permits an application to compose over the interface of another App without asking for the SYSTEM_ALERT_WINDOW benefit this ordinarily requires.

Vulnerability occurs due to lack of permission checks in code validation with Android AOSP (version <= 7.0) and with Android OS version 7.1 it has multiple layers of mitigation, First layer forcibly due to lack maximum timeout and second mitigation, Android 7.1 allows only one Toast window per app to be shown at a time.

Through the overlay attack, an installed malicious app can fool the user into giving the app Device Administrator permissions. With this, it will have the capability to launch deadly attacks, including:

  1. Locking the device screen
  2. Resetting the device PIN
  3. Wiping the device’s data
  4. Preventing the user from uninstalling the App

Google patched and disclosed this vulnerability on September 5th of 2017.


Latest articles

PoC Exploit Released For macOS Privilege Escalation Vulnerability

A new vulnerability has been discovered in macOS Sonoma that is associated with privilege...

CatDDoS Exploiting 80+ Vulnerabilities, Attacking 300+ Targets Daily

Malicious traffic floods targeted systems, servers, or networks in Distributed Denial of Service (DDoS)...

GNOME Remote Desktop Vulnerability Let Attackers Read Login Credentials

GNOME desktop manager was equipped with a new feature which allowed remote users to...

Kesakode: A Remote Hash Lookup Service To Identify Malware Samples

Today marks a significant milestone for Malcat users with the release of version 0.9.6,...

Cisco Firepower Vulnerability Let Attackers Launch SQL Injection Attacks

 A critical vulnerability has been identified in Cisco Firepower Management Center (FMC) Software's web-based...

Hackers Exploit WordPress Plugin to Steal Credit Card Data

Hackers have exploited an obscure WordPress plugin to inject malware into websites, specifically targeting...

Google Patches Chrome Zero-Day: Type Confusion in V8 JavaScript

Google has released a patch for a zero-day exploit in its Chrome browser.The...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles