Tuesday, October 15, 2024
HomeAndroidNewly Discovered Tap ’n Ghost Attack Let Hackers to Remotely Control Android...

Newly Discovered Tap ’n Ghost Attack Let Hackers to Remotely Control Android Smartphones

Published on

Malware protection

A new attack dubbed Tap ‘n Ghost targets NFC enabled Android smartphones, let attackers to trigger malicious events on the victim’s smartphone and to take control over the smartphone remotely.

Nowadays, smartphones are used to interact with several networking devices that include wireless headphones, fitness devices, contactless payment systems, and other devices.

To connect with the networking devices smartphones are shipped with a number of cellular networks such as Wi-Fi, Bluetooth, and NFC. The new attack leverages the Near Field Communication (NFC) implementation of the Android OS version 4.1 or later.

- Advertisement - SIEM as a Service

Researches from Waseda University proposed the Tap ’n Ghost attacks, and their survey with 300 respondents and a user study involving 16 participants shows that the attack is realistic.

Tap ’n Ghost Attack Techniques

With Tap ’n Ghost, researchers derived two attack techniques which let hackers trigger malicious events on the victim’s smartphone.

Tag-based Adaptive Ploy (TAP)

TAP attack works with a web server, it makes use of device fingerprinting and comprises NFC tag emulator and a single board computer with a Wi-Fi controller installed.

Once the victim phone comes near to the emulator, it reads the tag and launches the browser to open the malicious URL recorded in the NFC tag and the website employees the device fingerprinting about the victim device, based on the information computer determines the tag suited for the victim’s device.

“TAP system performs tailored attacks on the victim’s smartphone by employing device fingerprinting; e.g., popping up a customized dialog box asking whether or not to connect to an attacker’s Bluetooth mouse.”

Ghost Touch Generator

The attack relies on scattering the events around the original touch area, even if the victims want to touch a cancel button to disconnect from malicious Wi-Fi, the attack can make the system recognize as the touch of connect button.

“Ghost Touch Generator forces the victim to connect to the mouse even if she or he aimed to cancel the dialog by touching the “cancel” button; i.e., it alters the selection of a button on a screen,” reads the report.

The attack will succeed if it meets the following conditions

  • The smartphone comes with Android OS.
  • The smartphone is equipped with NFC.
  • The victim has enabled the NFC functionality.
  • The smartphone’s touchscreen controller is attackable
    with Ghost Touch Generator.
  • The victim has unlocked the smartphone when she or he
    brings it close to the Malicious Table.
  • Ghost Touch Generator attack has succeeded.

Attackers could use this new attack method to launch targeted attacks; a successful attack let hackers steal confidential information from the company.

Mitigations

These attacks can be prevented if the user authentication process is added before the Android OS launches applications recorded in an NFC tag.

Researchers noted that some touchscreen controllers stopped working when a strong electric field was applied. Although these observations are not conclusive, we conjecture that the manufactures of these controllers may have installed mechanisms to stop the controllers upon detection of external noises.

“Our attack is a proof-of-concept; we provide possible countermeasures that will thwart the threats. We believe that the concept of our attacks sheds new light on the security research of mobile/IoT devices,” researchers concluded.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Also Read:

Free tool to Check Website Security, Mobile app, SSL Security & Phishing Test

Hackers Abuse GitHub Service to Host Variety of Phishing Kits to Steal Login Credentials

Google to Block Logins From Embedded Browser Frameworks to Protect From Phishing & MitM Attacks

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Splunk Enterprise Vulnerabilities let Attackers Execute Remote Code

Splunk has disclosed multiple vulnerabilities affecting its Enterprise product, which could allow attackers to...

OilRig Hackers Exploiting Microsoft Exchange Server To Steal Login Details

Earth Simnavaz, an Iranian state-sponsored cyber espionage group, has recently intensified its attacks on...

CoreWarrior Malware Attacking Windows Machines From Dozens Of IP Address

Researchers recently analyzed a CoreWarrior malware sample, which spreads aggressively by creating numerous copies...

TrickMo Malware Targets Android Devices to Steal Unlock Patterns and PINs

The recent discovery of the TrickMo Banking Trojan variant by Cleafy has prompted further...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Splunk Enterprise Vulnerabilities let Attackers Execute Remote Code

Splunk has disclosed multiple vulnerabilities affecting its Enterprise product, which could allow attackers to...

OilRig Hackers Exploiting Microsoft Exchange Server To Steal Login Details

Earth Simnavaz, an Iranian state-sponsored cyber espionage group, has recently intensified its attacks on...

CoreWarrior Malware Attacking Windows Machines From Dozens Of IP Address

Researchers recently analyzed a CoreWarrior malware sample, which spreads aggressively by creating numerous copies...