Input Prompt
The operating system and installed applications often have legitimate needs to prompt the user for sensitive information such as account credentials, bank account information, or Personally Identifiable Information (PII). Adversaries may mimic this functionality to prompt users for sensitive information.
Compared to traditional PCs, the constrained display size of mobile devices may impair the ability to provide users with contextual information, making users more susceptible to this technique’s use.[1]
Specific approaches to this technique include:
Impersonate the identity of a legitimate application
A malicious application could impersonate the identity of a legitimate application (e.g. use the same application name and/or icon) and get installed on the device. The malicious app could then prompt the user for sensitive information.[2]
Display a prompt on top of a running legitimate application
A malicious application could display a prompt on top of a running legitimate application to trick users into entering sensitive information into the malicious application rather than the legitimate application. Typically, the malicious application would need to know when the targeted application (and individual activity within the targeted application) is running in the foreground, so that the malicious application knows when to display its prompt. Android 5.0 and 5.1.1, respectively, increased the difficulty of determining the current foreground application through modifications to the ActivityManager API.[3][4]. A malicious application can still abuse Android’s accessibility features to determine which application is currently in the foreground.[5] Approaches to display a prompt include:
- A malicious application could start a new activity on top of a running legitimate application.[1][6] Android 10 places new restrictions on the ability for an application to start a new activity on top of another application, which may make it more difficult for adversaries to utilize this technique.[7]
- A malicious application could create an application overlay window on top of a running legitimate application. Applications must hold the
SYSTEM_ALERT_WINDOWpermission to create overlay windows. This permission is handled differently than typical Android permissions, and at least under certain conditions is automatically granted to applications installed from the Google Play Store.[8][9][10] TheSYSTEM_ALERT_WINDOWpermission and its associated ability to create application overlay windows are expected to be deprecated in a future release of Android in favor of a new API.[11]
Fake device notifications
A malicious application could send fake device notifications to the user. Clicking on the device notification could trigger the malicious application to display an input prompt.[12]
Procedure Examples
| Name | Description |
|---|---|
| Anubis |
Anubis can create overlays to capture user credentials for targeted applications.[20] |
| Cerberus |
Cerberus can generate fake notifications and launch overlay attacks against attacker-specified applications.[23] |
| EventBot | |
| Ginp |
Ginp can use a multi-step phishing overlay to capture banking credentials and then credit card numbers after login.[21] |
| Gustuff |
Gustuff uses WebView overlays to prompt the user for their device unlock code, as well as banking and cryptocurrency application credentials. Gustuff can also send push notifications pretending to be from a bank, triggering a phishing overlay. [18][12] |
| Marcher |
Marcher attempts to overlay itself on top of legitimate banking apps in an effort to capture user credentials. Marcher also attempts to overlay itself on top of legitimate apps such as the Google Play Store in an effort to capture user credit card information.[14] |
| Pallas |
Pallas uses phishing popups to harvest user credentials.[16] |
| Riltok |
Riltok can open a fake Google Play screen requesting bank card credentials and mimic the screen of relevant mobile banking apps to request user/bank card details.[17] |
| Rotexy |
Rotexy can use phishing overlays to capture users' credit card information.[19] |
| Xbot |
Xbot uses phishing pages mimicking Google Play's payment interface as well as bank login pages.[13] |
| XcodeGhost |
XcodeGhost can prompt a fake alert dialog to phish user credentials.[15] |
Mitigations
| Mitigation | Description |
|---|---|
| Application Vetting | |
| Enterprise Policy |
An EMM/MDM can use the Android |
| Use Recent OS Version |
Detection
The user can view and manage which applications hold the SYSTEM_ALERT_WINDOW permission to create overlay windows on top of other apps through the device settings in Apps & notifications -> Special app access -> Display over other apps (the exact menu location may vary between Android versions).
References
- A.P. Felt and D. Wagner. (2011, May 26). Phishing on Mobile Devices. Retrieved August 25, 2016.
- Lukáš Štefanko. (2016, July 7). Fake finance apps on Google Play target users from around the world. Retrieved September 24, 2018.
- Android. (n.d.). ActivityManager getRunningTasks documentation. Retrieved January 19, 2017.
- Various. (n.d.). Android 5.1.1 and above - getRunningAppProcesses() returns my application package only. Retrieved January 19, 2017.
- ThreatFabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved September 18, 2019.
- R. Hassell. (2011, October 12-13). Exploiting Androids for Fun and Profit. Retrieved October 10, 2019.
- Android Developers. (n.d.). Restrictions on starting activities from the background. Retrieved September 18, 2019.
- Fratantonio, Y., et al.. (2017). Cloak & Dagger. Retrieved September 18, 2019.
- Ramirez, T.. (2017, May 25). ‘SAW’-ing through the UI: Android overlay malware and the System Alert Window permission explained. Retrieved September 18, 2019.
- Yair Amit. (2016, March 3). “Accessibility Clickjacking” – The Next Evolution in Android Malware that Impacts More Than 500 Million Devices. Retrieved December 21, 2016.
- Rahman, M.. (2019, May 8). Bubbles in Android Q will fully replace the overlay API in a future Android version. Retrieved September 18, 2019.
- Group-IB. (2019, March 28). Group-IB uncovers Android Trojan named «Gustuff» capable of targeting more than 100 global banking apps, cryptocurrency and marketplace applications. Retrieved September 3, 2019.
- Cong Zheng, Claud Xiao and Zhi Xu. (2016, February 18). New Android Trojan “Xbot” Phishes Credit Cards and Bank Accounts, Encrypts Devices for Ransom. Retrieved December 21, 2016.
- Proofpoint. (2017, November 3). Credential phishing and an Android banking Trojan combine in Austrian mobile attacks. Retrieved July 6, 2018.
- Claud Xiao. (2015, September 18). Update: XcodeGhost Attacker Can Phish Passwords and Open URLs through Infected Apps. Retrieved December 21, 2016.
- Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.
- Tatyana Shishkova. (2019, June 25). Riltok mobile Trojan: A banker with global reach. Retrieved August 7, 2019.
- Vitor Ventura. (2019, April 9). Gustuff banking botnet targets Australia . Retrieved September 3, 2019.
- T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.
- M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved April 8, 2020.
- ThreatFabric. (2019, November). Ginp - A malware patchwork borrowing from Anubis. Retrieved April 8, 2020.
- D. Frank, L. Rochberger, Y. Rimmer, A. Dahan. (2020, April 30). EventBot: A New Mobile Banking Trojan is Born. Retrieved June 26, 2020.
- Threat Fabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved June 26, 2020.