Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Android Toast Overlay Attack: “Cloak and Dagger” with No Permissions

Summary: Palo Alto Networks Unit 42 researchers found that Android's Toast window (TYPE_TOAST) can be used to draw overlays on top of other apps without requesting the SYSTEM_ALERT_WINDOW permission, because the code path lacks both a permission check and an operation check. The flaw, assigned CVE-2017-0752 and patched in the September 2017 Android Security Bulletin, affects all Android versions below 8.0, with Android 7.1 adding only a 3.5-second Toast timeout and a one-window-per-UID limit that the researchers bypassed by looping popups.

Key Takeaway: An app needs no permissions and no Google Play listing to run this attack, and if it lures the user into granting Device Administrator rights it can lock the screen, reset the PIN, wipe data, or hold the device for ransom - while the table shows 8.0 at 0.0% adoption, meaning nearly every Android device in the field is exposed.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Mentions
CVE-2017-0752
Related