Google Android UI Handler Overlay 弱身份验证 ⚔ [有争议]

CVSS 元临时分数	当前攻击价格 (≈)	CTI兴趣分数
7.3	$0-$5k	0.00

摘要信息

检测到一个被分类为致命的安全漏洞，影响Google Android。受此漏洞影响的是未知功能的组件UI Handler。由于被操作，进而引发弱身份验证（Overlay）。另外，有可用的漏洞利用。目前对于该漏洞的实际存在性仍有疑问。

检测到一个被分类为致命的安全漏洞，影响Google Android。受此漏洞影响的是未知功能的组件UI Handler。由于被操作，进而引发弱身份验证（Overlay）。使用CWE来声明会导致 CWE-290 的问题。此安全漏洞在 2015-04-01 由Tobias Ospelt 与modzero AG合作以Android apps in sheep's clothing编号以公告（网站）公开发布。索取公告的网址是modzero.ch。未与供应商协商即进行了公开发布。

暂无技术细节。此漏洞的受欢迎程度高于平均值。另外，有可用的漏洞利用。该漏洞的利用方式已向公众披露，存在被利用的风险。目前漏洞的结构决定了可能的价格范围为美元价USD $0-$5k。通告提到：

Overlaying and redressing attacks on Android are known for several years now. In the past, attackers abused toast messages to overlay user interface elements to pass touch events to hidden activities while the user is handling the interface of the malicious app on top. This is known as tap-jacking. Toast messages do not require special permissions. Android mitigated some of these issues with the filterTouchesWhenObscured attribute. However, our overlay attack, while still stealing information, uses different mechanisms. Therefore filterTouchesWhenObscured is no effective mitigation.

如果有长度，则声明为高功能性。漏洞利用工具已在play.google.com共享下载。作为零日漏洞，其地下市场的估计价格约为$25k-$100k。公告指出：

The attack is implemented in a malicious app, which may be distributed over any channel and it mimics a useful app (for example a torch app). The software registers a background service on boot and continuously monitors foreground applications. In this scenario, the attacker wants to collect account credentials of services, for example Skype, Amazon, and PayPal. If a foreground app’s package/class name matches the target name (for example “com.skype.android.app.signin.SignInActivity"), the malicious app overlays the login activity by rendering the faked login view (...) The original activity can be overlaid completely or partially, whatever is simpler for the attacker. For the Skype attack we chose to overlay the entire Activity. The attack may use the original app resources from its unpacked apk file (layout xml files) to get exactly the same look and feel of the original app. Once the user submits account credentials, the attacker hides the overlay and a home button press is activated to simulate an application crash. The malicious application diverts the stolen account credential to an external server (in the above demonstration the credentials are shown in the malicious app). From this point on no overlay is taking place anymore and the Skype app is working as expected.

目前对于该漏洞的实际存在性仍有疑问。

该公告包含如下评论：

The Android Security Team has been informed in spring 2014, but they don't consider this behavior an issue. According to an apparently completely independent issue (privacy reasons) Android 5 changed its tasks API (GET_TASKS), there are no credits are reference to our work [2][3]. This somewhat mitigates the issue that malicious apps are able to figure out precisely which Activity is in the foreground. However, by using a different API (ActivityManager.getRunningAppProcesses and comparing the importance to ActivityManager.RunningAppProcessInfo.IMPORTANCE_FOREGROUND) it is still possible to figure out which app is currently in the foreground on Android 5.