Screenmilker: How to Milk Your Android Screen for Secrets

Abstract

With the rapid increase in Android device popularity, the capabilities that the diverse user base demands from Android have significantly exceeded its original design. As a result, people have to seek ways to obtain the permissions not directly offered to ordinary users. A typical way to do that is using the Android Debug Bridge (ADB), a developer tool that has been granted permissions to use critical system resources. Apps adopting this solution have combined tens of millions of downloads on Google Play. However, we found that such ADB-level capabilities are not well guarded by Android. A prominent example we investigated is the apps that perform programmatic screenshots, a much-needed capability Android fails to support. We found that all such apps in the market inadvertently expose this ADB capability to any party with the INTERNET permission on the same device. With this exposure, a malicious app can be built to stealthily and intelligently collect sensitive user data through screenshots. To understand the threat, we built Screenmilker, an app that can detect the right moment to monitor the screen and pick up a user's password when she is typing in real time. We show that this can be done efficiently by leveraging the unique design of smartphone user interfaces and its public resources. Such an understanding also informs Android developers how to protect this screenshot capability, should they consider providing an interface to let third-party developers use it in the future, and more generally the security risks of the ADB workaround, a standard technique gaining popularity in app development. Based on the understanding, we present a mitigation mechanism that controls the exposure of the ADB capabilities only to authorized apps. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

What Mobile Ads Know About Mobile Users

“…There is a large body of work on direct and side-channel attacks that can be performed by malicious Android apps to steal other apps' secrets [10,28,30,40,49,57]. All of these papers assume that the victim has installed a malicious app on his or her device.…”

OS-level Side Channels without Procfs: Exploring Cross-App Information Leakage on iOS

“…Security of such mobile systems has been widely studied in the past decade, mostly in the context of Android [31], [36], [42], [45], [66], [67], with some limited effort on iOS [34], [37]. Of particular interest here are a series of side-channel attacks, which empower an untrusted third-party app (e.g., free games) to infer private user information by monitoring the execution of OS services or trusted apps (e.g., banking apps).…”

“…So far, this line of research has only been conducted on Android, with numerous studies [31], [36], [42], [45], [64], [67] showing that the OS and its underlying Linux kernel fail to properly control the information leaks from seemingly harmless sourcesprocfs, a pseudo filesystem available on UNIX-like operating systems (including Android) to export some kernel statistics (e.g., virtual and physical memory, CPU and network usage) to the user space. These statistics can be classified into two categories: per-process statistics and global statistics.…”

“…Per-process statistics reveals the information pertaining to a specific process, while global statistics reports aggregated information from all processes and the entire kernel. Most existing side-channel attacks exploit per-process statistics in procfs [31], [42], [45], [64], [67].…”

Inishing: A UI Phishing Attack to Exploit the Vulnerability of Inotify in Android Smartphones

“…However, this scheme cannot detect a specific screen among multiple screens composing an Activity and, moreover, can fail to detect an Activity in an app that has a complex connection structure among Activities. In Screenmilker [3], a malicious screenshot app detects a soft keyboard pop-up by the memory usage to capture a user's keystrokes. However, this attack is possible only in those smartphones in which the screenshot app has been installed using the ADB debugging tool.…”