YoU are GeTTing HaCKed! -'Cloak and Dagger Attack'

Android users may want to keep a close eye on the apps they download onto their devices as researchers have discovered a series of vulnerabilities in the operating system that relies on two particular Android permissions to work.

Dubbed Cloak & Dagger by the research team that discovered the vulnerability, the attack relies on abusing the SYSTEM_ALERT_WINDOW and BIND_ACCESSIBILITY_SERVICE permissions in order to compromise the system.

System vulnerabilities

The way the exploit works is pretty straightforward: a malicious app gets downloaded and installed to the Android device, with the necessary permissions being granted without requiring the user’s input.

From there, hackers are able to perform Clickjacking, record keystrokes, phishing, and even installing a God-mode app, all without the user being aware of it.

God-mode-app

Illustrate the danger that the vulnerability poses, the researchers have prepared three videos that demonstrates the potential attacks that could be carried out.

The first one is called the Invisible Grid Attack, and it works by placing an invisible overlay over the device’s keyboard. With it, the hacker could identify the information that is being typed out.

The second video depicts a clickjacking attempt that eventually culminates in a God-mode application being silently installed in the background without the user even noticing it.

Finally, the third video showcasing how a hacker could steal a password by manipulating the overlays.

Even newest Android version Android Nougat 7.1.2 might get affected due to this attack. So be aware of it.

As google is working on this problem, they will be coming with a solution pretty quickly. Stay safe!

Want  to learn Android Programming?