{"id":1423,"date":"2017-06-02T18:55:19","date_gmt":"2017-06-02T18:55:19","guid":{"rendered":"https:\/\/www.varutra.com\/blog\/?p=1423"},"modified":"2022-12-02T16:16:48","modified_gmt":"2022-12-02T10:46:48","slug":"beware-android-users-cloak-and-dagger-is-here-to-exploit-you","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/beware-android-users-cloak-and-dagger-is-here-to-exploit-you\/","title":{"rendered":"Beware Android Users – CLOAK AND DAGGER is here to exploit you"},"content":{"rendered":"

<\/p>\n

The WORLD has still not got over with the WannaCry ransomware <\/strong>menace and here comes one more android ransomware – Cloak and Dagger!<\/p>\n

\"Cloak<\/a><\/p>\n

People have been debating for years over Android V\/s iPhone. \u00a0It’s the ultimate battle. And it’s not ending anytime soon. But there is something Android users would not like to hear and iPhone users would rejoice about their choice\u2013 Android users are not safe!<\/p>\n

Yes, the Android OS which you and I are using (even the latest Android 7.1.2) is not safe, all your credentials, data are at major risk.<\/p>\n

Android users all over the world have always been a very popular target for criminals. It\u2019s not even a month researchers uncovered several malicious Android applications masqueraded as \u201cFunny Videos\u201d on Play Store which had over 5000 downloads; it did not only provide users with \u201cFunny Videos\u201d, but had \u2018BankBot banking Trojan\u2019 which also stole victim\u2019s banking password.<\/p>\n

Till now everyone thought that malware requires user interaction in order to get installed on any device or click on a link in a phishing email, or the installation of software from an unverified source. But Researchers now have discovered a new attack, called \u201cCloak and Dagger\u201d<\/strong>, that works against all versions of Android. Yes, even the latest version of Android isn\u2019t safe from this attack.<\/p>\n

It allows an attacker aka hackers to smoothly and silently take complete control of your device and steal private data of the device user like login credentials, using key logger and also by analyzing the keystrokes, personal chats, contacts without the users concern.<\/p>\n

This stealthy attack was first discovered researchers at the Georgia Institute of Technology in Atlanta last August. They were in discussion with Google and some vulnerabilities were fixed over months with updates, but some of them are still present in the latest version of the platform.<\/p>\n

 <\/p>\n

How does the attack take place?<\/strong><\/h3>\n

Cloak and Dagger attack is caused by 2 specific permissions the SYSTEM ALERT WINDOW and the BIND ACCESSIBILITY SERVICE.<\/p>\n

What makes it even more dangerous is the fact that the SYSTEM ALERT WINDOW permission is automatically granted for applications installed from Play Store, and it can easily trick the user into granting the BIND ACCESSIBILITY SERVICE permission and bootstrap the whole attack.<\/p>\n

This means, all you have to do is download an application (malicious) from the Android play store and rest will be taken care by the malicious code.<\/p>\n

 <\/p>\n

Let\u2019s know more about the permissions <\/strong><\/h3>\n

SYSTEM ALERT WINDOW<\/u><\/strong><\/h4>\n

This System alert window is nothing but \u201cDraw over other apps\u201d, used to draw overlays on top of other applications. According to the of\ufb01cial documentation, \u201cVery few applications should use this permission; these windows are intended for system-level interaction with the user.\u201d Despite this warning, the SYSTEM ALERT WINDOW is used by popular applications such as Facebook, LastPass, Twitter, and Skype. Furthermore, it is found that about 10.2% (454 out of 4,455) of top applications on Google Play Store require this permission.<\/p>\n

This means that, since the SYSTEM ALERT WINDOW permission is automatically granted, the user will not be noti\ufb01ed at any point.<\/p>\n

BIND ACCESSIBILITY SERVICE<\/u><\/strong><\/h4>\n

This permission is accessible for the Android users with disabilities. It can discover UI widgets displayed on the screen, query the content of these widgets, and interact with them programmatically. This permission is less popular than the previous permission. Among the top 4,455 applications on the Play Store, it is found that 24 applications use this service. It is worth noting that none of them are purely designed for people with disabilities! In fact, most of them are security applications such as password managers (e.g., app lockers, desk launchers, and antivirus applications. It is also found that 17 of these applications require both permissions.<\/p>\n

The combination of these two permissions leads to a stealthy, very popular attacks, called \u201cCloak and Dagger<\/strong>\u201d. It is called so as they take place undercover without user\u2019s knowledge.<\/p>\n

Conceptually, Cloak and Dagger<\/strong> is the \ufb01rst class of attacks that has successfully and completely compromise the UI feedback loop. It can modify what the user sees, detect the input\/reaction to the modi\ufb01ed display and update the display to meet user expectations. Similarly, the user can fake input, and it still manages to display to the user what they expect to see, instead of showing them the system responding to the injected input.<\/p>\n

This sharply contradicts the existing attacks that utilized either SYSTEM ALERT WINDOW or the BIND ACCESSIBILITY SERVICE permissions. With the use of only SYSTEM ALERT WINDOW permission (e.g., GUI confusion attacks), the attacker can modify what the user sees, but cannot anticipate how\/when the user reacts to the modi\ufb01ed display, and hence fails to change the modi\ufb01ed displayed content accordingly. Similarly, by using BIND ACCESSIBILITY SERVICE permission alone, the attacker can inject fake user inputs, but the attacker here cannot prevent the user from seeing the results of these fake inputs displayed on the screen. As a result, in both cases, with only one of the two permissions, the user can very quickly discover the attack.<\/p>\n

On the contrary, in Cloak and Dagger<\/strong>, \u00a0the combination of the two permissions allows an attacker to both modify what the user sees and inject fake input, all while maintaining the expected \u201cUser experience\u201d.<\/p>\n

The potential consequences of the Cloak and Dagger<\/strong> attacks include almost complete control over the victim\u2019s device – context-aware clickjacking attacks, perform (unconstrained) keystroke recording, steal user\u2019s credentials, security PINs, and two-factor authentication tokens, and silently install a God-mode application with all permissions enabled.<\/p>\n

According to the research, the flaws allow malicious applications downloaded from the Google Play Store to take control of the operating system\u2019s user interface feedback loop. Thereby taking control of the device. What makes it more dangerous is the fact that user would be completely unaware of this malicious activity taking place.<\/p>\n

The researchers have examined the attack and explained how they got on the Google Play Store to perform Cloak & Dagger attacks. They first submitted an application which got approved just after few hours and it is been said that it is still available on the Play Store. That application contained a non-obfuscated functionality to download and execute arbitrary code (to simulate malicious behaviour).<\/p>\n

Once installed, the researchers say the attacker can perform various malicious activities including:<\/p>\n