Hacker News Reader

Comment by tptacek | Hacker News Reader

This seems like a refinement of "tap-jacking", which is a pretty well-known UI redressing attack for Android apps, and works in a way that is somewhat similar to "clickjacking" on web pages --- an invisible frame is rendered on top of the application that captures inputs (as opposed to an opaque frame that obscures the legitimate application and tricks you into interacting with it).

The big limitation on these attacks is that you have to install a malicious application and then trick people into getting to a situation where the application can interact with a specific target; that's something that should be straightforward for app stores to screen for.

View on HN

I agree. Once you've got the malicious app, it's already too late. As they point out, Facebook could arguably tap jack all your passwords too. Known issue, so pretending it's a new issue by giving it a new name is silly.

I'm less concerned with whether it's original and more with whether it's a serious silent attack on my phone (yes?). And whether Google intends to fix the problem (no?).

Why do they need a specific target in-this case, it appears from the video like they can overlay the keyboard and simply grab all keyboard input?

> that's something that should be straightforward for app stores to screen for.

Also wouldn't it be relatively viable to gain update access to a popular existing application or to provide an innocuous application at first and then push a patch enabling this vulnerability?

> they can overlay the keyboard and simply grab all keyboard input?

Keyboards have variable heights, widths, etc, so they at least have to know what the keyboard looks like.

Most of users use same and default keyboards. Even if you use different keyboard, with click heatmaps, they could find out keyboard layout and specs.

No. Why would OS assume any thing but maliciousness from apps ? The appstore is not part of OS, why would it then perform a security-critical function ? Why would you even involve humans to ensure security ?

These are dangerous engineering decisions and should be publicized as much as possible not tone it down.

Additionally, stores like F-droid and whatever Samsung has exist, so the check needs to be further down into the OS, like you said.

How is the invisible frame able to pass taps through to the app underneath?

You can use onTouchEvent even when not receiving taps.

Reply on news.ycombinator.com