Story image

Android 'Toast' overlay vulnerability affects all versions prior to 8.0

11 Sep 17

Android users are being urged to apply any security patches for their devices, after security researchers discovered a ‘high severity’ vulnerability in Toast.

The Android Toast overlay exploits all versions of Android prior to the latest version, Android Oreo. According to researchers at Unit 42, the vulnerability increases the likeliness of an overlay attack, although they are not aware of any attacks that have used the vulnerability.

Overlay attacks are already well-known on Android.

“An “overlay attack” is an attack where an attacker’s app draws a window over (or “overlays”) other windows and apps running on the device. When done successfully, this can enable an attacker to convince the user he or she is clicking one window when, in fact, he or she is actually clicking another window,” Unit 42 researcher Christopher Budd explains.

They are used to install malicious software on an Android device in order to control or ‘brick’ it, steal information, demand ransoms or do all of those things in one swoop.

Overlay attacks can also be used to create denial-of-services on the device by opening windows that cannot be closed – a key use for the way ransomware attacks are conducted.

Previously, it was believed that malicious apps that attempt to conduct overlay attacks had to explicitly request the ‘draw on top’ permission from the user, and the apps must be installed through Google Play.

Because of these two factors, overlay attacks were previously ruled a non-serious threat. However, researchers say that overlay attacks can occur without those two conditions. 

Android devices are built with a feature called ‘Toast’, which is a notification that pops up on the screen. It is generally used to show notifications and messages over apps.

Toast does not require the same permissions as other Android window types and it is also able to overlay the entire screen.

“If a malicious app were to utilize this new vulnerability, our researchers have found it could carry out an overlay attack simply by being installed on the device. In particular, this means that malicious apps from websites and app stores other than Google Play can carry out overlay attacks. It’s important to note that apps from websites and app stores other than Google Play form a significant source of Android malware worldwide,” Budd explains.

While Budd says that Android Oreo is immune from the vulnerability, but all Android users before 8.0 should contact their handset maker or mobile carrier for the latest updates.

“Of course, one of the best protections against malicious apps is to get your Android apps only from Google Play, as the Android Security Team aggressively screens against malicious apps and keeps them out of the store in the first place,” Budd concludes.

Symantec releases neural network-integrated USB scanning station
Symantec Industrial Control System Protection Neural helps defend against USB-borne cyber attacks on operational technology.
SingleSource scores R&D grant to explore digital identity over blockchain
Callaghan Innovation has awarded a $318,000 R&D grant to Auckland-based firm SingleSource, a company that applies risk scoring to digital identity.
Ramping up security with next-gen firewalls
The classic firewall lacked the ability to distinguish between different kinds of web traffic.
Spark Lab launches free cybersecurity tool for SMBs
Spark Lab has launched a new tool that it hopes will help New Zealand’s small businesses understand their cybersecurity risks.
Gartner names LogRhythm leader in SIEM solutions
Security teams increasingly need end-to-end SIEM solutions with native options for host- and network-level monitoring.
Cylance makes APIs available in endpoint detection offering
Extensive APIs enable security teams to more efficiently view, enrich, and contextualise real-time intelligence collected at the endpoint to keep systems secure.
SolarWinds adds SDN monitoring support to network management portfolio
SolarWinds announced a broad refresh to its network management portfolio, as well as key enhancements to the Orion Platform. 
JASK prepares for global rollout of their AI-powered ASOC platform
The JASK ASOC platform automates alert investigations, supposedly freeing the SOC analyst to do what machines can’t.