Occupy Your Icons Silently on AndroidFireEye mobile security researchers have discovered a new Android
security issue: a malicious app with normal protection level
permissions can probe icons on Android home screen and modify them to
point to phishing websites or the malicious app itself without
notifying the user. Google has acknowledged this issue and released
the patch to its OEM partners.
Normal vs. Dangerous Permissions: A Background
Android Open Source Project (AOSP) classifies Android permissions
into several protection levels: “normal”, “dangerous”, “system”,
“signature” and “development” [ href="http://developer.android.com/guide/topics/manifest/permission-element.html">1][ href="https://android.googlesource.com/platform/frameworks/base/+/master/core/res">2][3].
Dangerous permissions “may be displayed to the user and require
confirmation before proceeding, or some other approach may be taken to
avoid the user automatically allowing the use of such facilities”. In
contrast, normal permissions are automatically granted at
installation, “without asking for the user's explicit approval
(though the user always has the option to review these permissions
before installing)” [1].
On the latest Android 4.4.2 system, if an
app requests both dangerous permissions and normal permissions,
Android only displays the dangerous permissions, as shown in Figure 1.
If an app requests only normal permissions, Android doesn’t display
them to the user, as shown in Figure 2.
class=" wp-image-5156 aligncenter portrait-sm"
style="border: 0.0px none;"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/04/and1.png"
width="344" height="550" />
Figure 1. An Android app asks for one dangerous permission
(INTERNET) and some normal permissions (Launcher’s
READ_SETTINGS and WRITE_SETTINGS). Android doesn’t
notify the user about the normal permissions.
class=" wp-image-5157 aligncenter portrait-sm"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/04/and2.png"
width="343" height="549" />
Figure 2. An Android app asks for normal permissions
(Launcher’s READ_SETTINGS and WRITE_SETTINGS) only.
Android doesn’t show any permission to the user.
Normal Permissions Can Be Dangerous
We have found that certain “normal”
permissions have dangerous security impacts. Using these normal
permissions, a malicious app can replace legit Android home screen
icons with fake ones that point to phishing apps or websites.
The ability to manipulate Android home
screen icons, when abused, can help an attacker deceive the user.
There’s no surprise that the
com.android.launcher.permission.INSTALL_SHORTCUT
permission, which allows an app to create icons, was recategorized
from “normal” to “dangerous” ever since Android 4.2. Though this is
an important security improvement, an attacker can still manipulate
Android home screen icons using two normal permissions:
com.android.launcher.permission.READ_SETTINGS and
com.android.launcher.permission.WRITE_SETTINGS. These two
permissions enable an app to query, insert, delete, or modify the
whole configuration settings of the Launcher, including the icon
insertion or modification. Unfortunately, these two permissions have
been labeled as “normal” since Android 1.x.
As a proof of concept attack scenario, a
malicious app with these two permissions can query/insert/alter the
system icon settings and modify legitimate icons of some
security-sensitive apps, such as banking apps, to a phishing
website. We tested and confirmed this attack on a Nexus 7 device
with Android 4.4.2. (Note: The testing website was brought down
quickly and nobody else ever connected to it.) Google Play doesn’t
prevent this app from being published and there’s no warning when a
user downloads and installs it. (Note: We have removed the app from
Google Play quickly and nobody else downloaded this app.)
Lastly, this vulnerability is not limited
to Android devices running AOSP. We have also examined devices that
use non-AOSP Launchers, including Nexus 7 with CyanogenMod 4.4.2,
Samsung Galaxy S4 with Android 4.3 and HTC One with Android 4.4.2.
All of them have the protection levels of
com.android.launcher.permission.READ_SETTINGS and
WRITE_SETTINGS as “normal”.
Google acknowledged this vulnerability
and has released the patch to its OEM partners. Many android vendors
were slow to adapt security upgrades. We urge these vendors to patch
vulnerabilities more quickly to protect their users.
References:
Source:
Occupy Your Icons Silently on Android
