Story image

Android 'Toast' overlay vulnerability affects all versions prior to 8.0

11 Sep 2017

Android users are being urged to apply any security patches for their devices, after security researchers discovered a ‘high severity’ vulnerability in Toast.

The Android Toast overlay exploits all versions of Android prior to the latest version, Android Oreo. According to researchers at Unit 42, the vulnerability increases the likeliness of an overlay attack, although they are not aware of any attacks that have used the vulnerability.

Overlay attacks are already well-known on Android.

“An “overlay attack” is an attack where an attacker’s app draws a window over (or “overlays”) other windows and apps running on the device. When done successfully, this can enable an attacker to convince the user he or she is clicking one window when, in fact, he or she is actually clicking another window,” Unit 42 researcher Christopher Budd explains.

They are used to install malicious software on an Android device in order to control or ‘brick’ it, steal information, demand ransoms or do all of those things in one swoop.

Overlay attacks can also be used to create denial-of-services on the device by opening windows that cannot be closed – a key use for the way ransomware attacks are conducted.

Previously, it was believed that malicious apps that attempt to conduct overlay attacks had to explicitly request the ‘draw on top’ permission from the user, and the apps must be installed through Google Play.

Because of these two factors, overlay attacks were previously ruled a non-serious threat. However, researchers say that overlay attacks can occur without those two conditions. 

Android devices are built with a feature called ‘Toast’, which is a notification that pops up on the screen. It is generally used to show notifications and messages over apps.

Toast does not require the same permissions as other Android window types and it is also able to overlay the entire screen.

“If a malicious app were to utilize this new vulnerability, our researchers have found it could carry out an overlay attack simply by being installed on the device. In particular, this means that malicious apps from websites and app stores other than Google Play can carry out overlay attacks. It’s important to note that apps from websites and app stores other than Google Play form a significant source of Android malware worldwide,” Budd explains.

While Budd says that Android Oreo is immune from the vulnerability, but all Android users before 8.0 should contact their handset maker or mobile carrier for the latest updates.

“Of course, one of the best protections against malicious apps is to get your Android apps only from Google Play, as the Android Security Team aggressively screens against malicious apps and keeps them out of the store in the first place,” Budd concludes.

Privacy: The real cost of “free” mobile apps
Sales of location targeted advertising, based on location data provided by apps, is set to reach $30 billion by 2020.
Forrester names Crowdstrike leader in incident response
The report provides an in-depth evaluation of the top 15 IR service providers across 11 criteria.
Norwegian aluminium manufacturer hit hard by LockerGoga ransomware attack
“IT systems in most business areas are impacted and Hydro is switching to manual operations as far as possible.”
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.
Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.
Alcatraz AI to replace corporate badges with AI security
The Palo Alto-based startup supposedly leverages facial recognition, 3D sensing, and machine learning to enable secure access control.
Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.
Mozilla launches Firefox Send, an encrypted file transfer service
Mozille Firefox has launched a free encrypted file transfer service that allows people to securely share files from any web browser – not just Firefox.