TapTrap: Animation‑Driven Tapjacking on Android

86•Bogdanp•6mo ago

Comments

tehwebguy•6mo ago

> independently and confidentially reported by @MG193_7 (ByteDance IES RedTeam) to the Android Security Team in early 2023

I wonder if this is in the wild anywhere, it has to be after 2.5 years right?

SoftTalker•6mo ago

Another reason not to install random apps.

subscribed•6mo ago

You probably forgot about multiple instances of malware found in the official Google Play store.

master-lincoln•6mo ago

What makes you think so? Apps in the Google Play store could be called random apps too. I guess the poster was more leaning towards trusting the developer of an app.

SoftTalker•6mo ago

I include most of Play Store apps in my definition of "random apps." If it's not from a very mainstream publisher I won't install it.

qbane•6mo ago

This has a long history dating back to the Flash era.

https://owasp.org/www-community/attacks/Clickjacking

> One of the most notorious examples of Clickjacking was an attack against the Adobe Flash plugin settings page. By loading this page into an invisible iframe, an attacker could trick a user into altering the security settings of Flash, giving permission for any Flash animation to utilize the computer’s microphone and camera.

user_7832•6mo ago

> If you use an Android phone and haven’t disabled system animations, then yes, you’re likely affected. iPhone users are not affected.

Okay... that was much worse than I expected. Looks like you can get the victim to click anywhere, which looks bad. I thought Android had protections against this?

> It is based on transition animations instead of overlays, so it doesn’t need special permissions and isn’t blocked by Android’s overlay protections.

Oh well. Not sure how that slipped past.

altfredd•6mo ago

This might be somewhat less threatening then it sounds, because it requires caller to fully control animations used for entering the targeted Activity.

In particular, this vulnerability might not overcome root permission prompts on rooted devices, because their windows are launched and controlled by the installed su app, not by attacker.

wiseowise•6mo ago

Sleek website.

_vere•6mo ago

Actually insane that this isn't patched in AOSP yet, literally the only android devices that aren't vulnerable are those running graphene. For companies as big as google, there really ought to be just disgusting financial penalties if they leave something like this unfixed for this amount of time.

svpk•6mo ago

GrapheneOS resolved this a while ago. Which shows google and other android vendors could have resolved this quickly if they were motivated too.

https://bsky.app/profile/minimalblue.bsky.social/post/3lul6i...

chasing0entropy•6mo ago

C'mon guys, Google hasn't neglected patching this for years because it would conflict with their own software's behavior, right?

Right?

trehalose•6mo ago

I fully share your distrust of Google, and I think it's unforgivable that they still haven't patched it, yet it's not obvious to me what of their own software would rely on it not being patched? (Are you suggesting Google exploits this vulnerability themself? That seems unlikely to me--they can make their own operating system do whatever evil they want it to; why would they need to trick the user into doing it for them?)

Show HN: Poddley.com – Follow people, not podcasts

Layoffs Surge 118% in January – The Highest Since 2009

Papyrus 114: Homer's Iliad

DicePit – Real-time multiplayer Knucklebones in the browser

Turn-Based Structural Triggers: Prompt-Free Backdoors in Multi-Turn LLMs

Show HN: AI Agent Tool That Keeps You in the Loop

Why Every R Package Wrapping External Tools Needs a Sitrep() Function

Achieving Ultra-Fast AI Chat Widgets

Show HN: Runtime Fence – Kill switch for AI agents

Researchers surprised by the brain benefits of cannabis usage in adults over 40

Peter Thiel warns the Antichrist, apocalypse linked to the 'end of modernity'

USS Preble Used Helios Laser to Zap Four Drones in Expanding Testing

Show HN: Animated beach scene, made with CSS

An update on unredacting select Epstein files – DBC12.pdf liberated

Was going to share my work

Pitchfork: A devilishly good process manager for developers

You Are Here

Why social apps need to become proactive, not reactive

How patient are AI scrapers, anyway? – Random Thoughts

Vouch: A contributor trust management system

I built a terminal monitoring app and custom firmware for a clock with Claude

Tiny C Compiler

Y Combinator Founder Organizes 'March for Billionaires'

Ask HN: Need feedback on the idea I'm working on

OpenClaw Addresses Security Risks

Apple finalizes Gemini / Siri deal

Italy Railways Sabotaged

Emacs-tramp-RPC: high-performance TRAMP back end using MsgPack-RPC

Nintendo Wii Themed Portfolio

"There must be something like the opposite of suicide "