flaw in Android's GUI framework let university researchers hack into applications with up to 92 percent success rate.
They tested apps from Gmail, H&R Block, Newegg, WebMD, Chase Bank,Hotels.com and Amazon.
"Changes in the shared memory side channel allow an attacker to infer if there is an activity transition going on in the foreground," researcher Zhiyun Qian, an assistant professor at the University of California at Riverside, told LinuxInsider.
"This is a design choice by modern OSes ... . The same attack may work as well [on other mobile OSes]," he added.
Details of the Flaw
When a new screen or window is shown, the GUI framework allocates a fixed amount of memory in the shared memory register that's proportional to the size of the screen, Qian said. This memory is allocated inside the app process and shared with a separate window compositor process.
Shared memory is commonly adopted by window managers to receive window changes or updates from running applications. This gives rise to the side channel.
When a user downloads a malicious app, the shared memory lets attackers steal information such as login credentials, and obtain sensitive camera images such as photos of personal checks sent through banking apps
No comments:
Post a Comment