• Android Tapjacking Vulnerability •

Android Tapjacking Vulnerability

Benjamin Lim (A0100223)
National University of Singapore
[email protected]

April 22, 2015

arXiv:1507.08694v1 [cs.CR] 30 Jul 2015

Abstract

Android is an open source mobile operating system that is developed mainly by Google. It is used on a
significant portion of mobile devices worldwide. In this paper, I will be looking at an attack commonly
known as tapjacking. I will be taking the attack apart and walking through each individual step required
to implement the attack. I will then explore the various payload options available to an attacker. Lastly, I
will touch on the feasibility of the attack as well as mitigation strategies.

I. Introduction 1. Open the App detail 1 page of the target

app
he tapjacking attack basically tricks the user
T into tapping on an object in the background
layer by clever positioning of a foreground 2. Tap Install
layer that is not tappable. Hence, any user
touches will be applied onto the background
layer which is not visible to the user. It is essen-
tially a delivery mechanism and the payload
can be customised by the attacker. The exploit
is payload and aspect ratio specific, therefore
the exploit code will need to be modified de-
pending on the payload desired by the attacker
as well as the target device’s aspect ratio. The
attack is also limited by the screen real estate
of the device, I will be elaborating more on that
in the section on developing the application.

3. Tap Accept
II. Exploiting the vulnerability

I. Payload Selection
The first step in developing the exploit will be
to choose a payload. For this walkthrough, I
will be using the application installer payload.
We will need to note down the location and
number of taps a user would make in order
to install an application. In the case of Google
Play, the steps are as follows.
1 We can access the app detail page directly through market:// url. Hence, we do not need to search for the app.

1
 • Android Tapjacking Vulnerability •

II. Developing the application The images have to be placed such that no
image overlaps a tappable area of any previous
Once the desired payload and steps has been screen. E.g. The image for the install button
identified, we can move on to developing the has been shifted to the left slightly so it does
application. We would need to create a toast not overlap the "Learn More" link in the per-
activity and have the image overlay the buttons missions page. This minimises the probability
which need to be pressed. Toasts are normally of the exploit failing. Thus the attack in prac-
used to display short text notifications and any tical is limited to 2 to 3 clicks at most due to
taps will be filtered down to the background limited screen real estate. Furthermore, the
layer. Positioning of the toast has to be done attack will also be unlikely to work if the size
by trial and error. We will want to use density of the button is too small as it will be difficult
independent pixels (dp) when specifying the as the victim might not be able to tap the exact
position so that the exploit code will work on spot.
devices with different resolutions but same
aspect ratios.

2
 • Android Tapjacking Vulnerability •

The next step would involve setting the The second app will most likely request the
toast to repeat on a loop so that is always dis- following core permissions.
played on the screen and set the background
of the toast to white so as to obscure the target
application.
1. RECEIVE_BOOT_COMPLETED - Allows
the attacker to start a service in the back-
ground whenever the phone is restarted.
Thus the user does not even need to run
the application.

2. INTERNET - Allows upload of data on

the phone to the attacker’s server
At this point, we might want to include baits
promising the user an incentive if they tap on
the image repeatedly. We are now done with
the development of the exploit and it can be
3. ACCESS_NETWORK_STATE - The at-
packaged and installed on the target device via
tacker might want to upload data only
an appropriate method.
when WiFi is active so as not to use up
too much quota and raise suspicions.
III. Attack Impact
As mentioned in the introduction section, the
tapjacking attack is a delivery mechanism, Depending on the attacker’s motive, he
hence its impact would depend on the pay- can make use of any of the following per-
load. missions (ACCESS_FINE_LOCATION, CAM-
ERA, RECORD_AUDIO, READ_CALENDAR,
READ_CALL_LOG, READ_CONTACTS,
I. Installer Payload READ_SMS, READ_EXTERNAL_STORAGE...
Assuming that the attacker chose to use the in- ) to compromise the privacy of the target user.
staller payload, he would be able to perform a
There are a few tactics an attacker
privilege escalation through the stealthy instal-
can use to conceal the attack from the
lation of a second app which requires multiple
user. One of the methods involves re-
permissions that the user did not agree to. The
moving the app icon from the launcher
exploit app itself does not require any permis-
and can be achieved by replacing "an-
sions.
droid.intent.category.LAUNCHER" in the man-
ifest file with "android.intent.category.DEFAULT".
Therefore, the user will not be able to locate
the app when he swipes through the list of
installed apps on the launcher. The second
method is to use a generic name such as
"Android Update Service" or "Bluetooth Con-
nection Helper". On encountering such an
application, a user will likely assume that the
application is part of the Android operating
system and will ignore the application.

3
 • Android Tapjacking Vulnerability •

II. Alternative Payload most difficult to pull off.

II.1 URL based Payload

Apart from the installer payload, which is

IV. Attack Feasibility
triggered by opening a "market://" URL in a
1. Exploitability - Proof of Concept
webview, other URL based payloads include a
"http(s)://" and a "tel://" payload. The HTTP
payload will allow an attacker to open any 2. Impact - High
URL inside a webview. The webpage could
contain a full screen button which could trig- 3. Complexity - Very High
ger a file download or run code which exploits
a vulnerability in the webview container. How- 4. Overall - Low
ever, the tapjacking application will need the
permission to access the internet which could Only proof of concept code is available at
raise user’s suspicions. the moment. Thus an attacker will need to
know basic android development in order to
The "tel://" payload will cause the user to write or modify the code needed to exploit the
silently dial a number in the background. It vulnerability. As of now, there does not exist
does not have such a high impact on security any tool which would automate the develop-
and the worst that could happen would be that ment of such an app when fed a payload.
the attacker programmed the payload with a
premium number and the user would be left The impact of the attack is (potentially) high
with a higher phone bill than expected. and depends on the type of payload. In the
case of the installer payload, an attacker would
II.2 Other Intent based Payload be able to access the call information, SMSes,
location, files on SD card, camera and micro-
Apart from URLs, an attacker can also use phone, completely compromising the privacy
intents to launch other activities. For example, of the user. Hence, the impact is relatively
the Settings activity can be called up using severe.
the following snippet of code "new Intent( an-
droid.provider.Settings.ACTION_SETTINGS)". Complexity is very high because the attacker
With the Settings activity in the background, has first got to convince the user to install
the attacker can then trick the user into per- the application. He then has to convince the
forming various actions ranging from switch- user to comply with the instructions and tap
ing on and off Wifi and Bluetooth to allowing repeatedly on the images. Lastly, there is a
installation of apps from unknown sources. substantial chance of failure especially if the
user’s taps are not accurate.
The attacker can also use intents to
launch third party applications using In summary, the attack is not feasible because
the following code snippet "getPack- it requires the attacker to be skilled enough to
ageManager().getLaunchIntentForPackage( write custom code and the user to be gullible
"com.bank.app"); The impact of the attack enough to follow through with instructions.
would depend on the app in question. Need- The attack is also not scalable as it only works
less to say, the attacker would need to ensure on devices of a specific aspect ratio. A skilled
that the target user has the target application attacker would be able to compromise phones
installed and must be familiar with the various in masses using easier techniques. Therefore,
activities and layout of the target application. this attack is not feasible and likely only used
This variation of the attack is thus one of the in a targeted attack.

4
 • Android Tapjacking Vulnerability •

V. Mitigation Strategies stores. They should look out for suspicious

behaviour such as unsolicited app installs and
According to an unofficial source [1], the tap- practice common sense.
jacking vulnerability was claimed to have been
patched in Android version 4.0.3. However,
I have successfully carried out this attack on VI. Conclusion
my phone which is running Android 4.3. I
I have walked through the process of planning
am unable to ascertain if this is because the
and developing an application that exploits the
manufacturer of my phone has not applied
tapjacking vulnerability. Even though there is
the patch in their images or whether the patch
not much an android user can do to protect
does not exist.
himself from such an attack, there is little cause
for concern as the attack is not feasible to pull
Developers can set the filterTouchesWhenOb-
off. Nevertheless, android users should still
scured property to true or override the on-
adopt good security practices to thwart other
FilterTouchEventForSecurity method. Setting
attacks out there. Lastly, developers should
the property to true is the declarative secu-
also play a more active role in ensuring that
rity method and will ignore all taps when the
their applications are safe from such attacks.
app is not in the foreground. Overriding the
method is the programmatic security approach
and gives the developer more flexibility. He VII. Acknowledgements
can choose to ignore or to process the taps
based on certain conditions. i.e. if the app was Part of the code was shamelessly taken from
in the foreground within the last 5 seconds. nVisium’s tapjacking proof of concept [2]. The
Given that even Google Play itself is vulnera- code was then revised for a more updated ver-
ble, it is unlikely that many developers practice sion of the android SDK and customised for
either one of the methods above. the aspect ratio of my phone. I then stripped
out some of the features so I could demonstrate
This is little that users can do to guard them- how tapjacking works in the background.
selves against a tapjacking attack. But in gen- A copy of my application code can be found
eral, users should try not to download obscure at https://github.com/limbenjamin/tapjacking
apps or download apps from third party app and is open sourced under the MIT license.

5
 • Android Tapjacking Vulnerability •

References
[1] CommonsWare, LLC.
The CommonsBlog - Tapjacking, Defunct?
http://commonsware.com/blog/2012/03/03/tapjacking-defunct.html
Retrieved 22 April 2015.

[2] nVisium LLC.

nVisium/TapJacking-Demo - GitHub
https://github.com/nVisium/TapJacking-Demo
Retrieved 22 April 2015.

[3] developer.android.com
Intent | Android Developers
http://developer.android.com/reference/android/content/Intent.html
Retrieved 22 April 2015.

[4] Trend Micro Inc.

Tapjacking: An Untapped Threat in Android
http://blog.trendmicro.com/trendlabs-security-intelligence/tapjacking-an-untapped-
threat-in-android/
Retrieved 22 April 2015.

[5] Cooper, Vanessa.

Tapjacking Threats and Mitigation Techniques for Android Applications (2014). Dissertations,
Theses and CapstoneProjects.Paper 632.