A group of researchers presented at the 23rd Annual USENIX Security Symposium in San Diego today findings that revealed a weakness in the Android operating system that could be used to access personal information from users through a variety of popular apps.
Dubbed the “UI state inference attack,” the researchers announced findings showing that for 6 out of 7 popular Android apps, the attack was successful 80-90 percent of the time, without requiring any privileges.
The popular apps tested included Gmail and H&R Block, yielding a 92 percent attack success rate; Newegg (86 percent); WebMD (85 percent); CHASE Bank (83 percent); Hotels.com (83 percent); and Amazon, with the lowest success rate of only 48 percent.
“The underlying problem is that popular GUI frameworks by design can potentially reveal every UI state change through a newly-discovered public side channel — shared memory,” reported the University of Michigan and University of California, Riverside researchers in a paper.
By deceiving users into download a seemingly harmless app, such as free background wallpapers, the group developed several attack scenarios that demonstrated how an attacker could steal information using the device’s shared memory, including images taken by the user when using the tested Android apps (a common feature in many mobile banking apps).
The researchers created videos demonstrating how the attack works on some of the tested apps:
Although their research was demonstrated on an Android phone, the researchers claim the weakness also likely exists in Windows and iOS devices, due to a similar shared memory feature present in all three operating systems.
In response to their findings, Qian recommends users to simply not install untrusted apps. However, in order to improve the device’s operating system, “a more careful tradeoff between security and functionality needs to be made in the future.”
Read More Here…