4 ms·

Just curious, is this restricted to Android only?

by walty8 8y ago

gbear605 8y ago
A lot of this is not possible in iOS, because it doesn’t allow drawing on top of alert type messages. The attacks relating to password managers are probably still relevant. Possibly so are the ones relating to accessibility, although I don’t think iOS allows accessibility controls access like Android does.
- closeparen 8y ago
  iOS doesn't allow apps to draw over other apps at all, AFAIK.
  - saagarjha 8y ago
    * In some very specific cases apps can "draw" on top of other apps, namely though the "app extension" mechanism which is completely out-of-process and very tightly controlled (for example, apps have very limited ability to modify the context outside of the "rectangle" they render in).
- chii 8y ago
  So the question is whether the trade-off of accessibility capabilities worth the decrease in security?
  - henvic 8y ago
    In general terms, iOS accessibility is far greater than Android's. I would say this is more akin to a feature than accessibility, in practical means...
    - saagarjha 8y ago
      iOS does accessibility natively and does not allow apps access to it to the extent that Android does, AFAIK.
on_and_off 8y ago
The "draw on top" hole is a known issue on Android that iOS does not share (since you can't do that on iOS afaik). Google has several time been tempted to just remove it but since many have legitimate use cases for it that are very popular (like facebook messaging bubble), it has been not been removed fully. Like it is mentioned in the talk, you need the 'draw on top' permission to do so. The caveat is that apps downloaded from the play store get it by default. From what I have seen, the talk seem to only talk about the doability of such an attack, not that it has been seen in the wild ? In theory, you could craft an app with a legitimate draw on top behavior + the malware one and get it published that way. The approval/rejection on the play store is very obscure though, so hard to get any more info on that. IIRC, Google has also added a "an app is drawing on top of the screen" permanent notification when an app does so, causing many people to be pissed at this 'useless' notification. ffs. iOS does have a11y capabilities as well, so there is that surface of attack, although I don't know if it is exploited.
- sk0g 8y ago
  I'm assuming the draw on top is through a specific API right? Why not have a section for (if you do use the feature) justifying why you need draw on top. Then have someone go over the source code to verify that the information volunteered matches up with what is going on behind the scenes. Or just decrypt APK and search for usages of the library? Also, why is such an intrusive feature enabled by default?! I want proper prompts explaining why they want it, and to be able to decide if I want to give them those permissions.
  - iforgotpassword 8y ago
    > Then have someone go over the source code That someone is who exactly? Did you ever try to contact support for any google product and get more than some standard text blocks back? And that's just regular support people. For what you suggest you'd need an army of people literate in Java, reviewing any app with that permission, including every update, ever uploaded to the app store. The best way would be to just get rid of this feature, and then maybe look at what the most common use cases for it were and add a few APIs for those.
  - 8y ago
geocar 8y ago
Apple doesn't support overdraw across apps, but there are still things Apple can learn here. Many system apps still use "insecure" dialogs that can (and are!) used to train users to do unsafe things. This[1] dialog can be drawn by an app (or injected using an advertisement!), and Apple ID failures are "common enough" that this works to collect people's Apple IDs. [1]: https://i.imgur.com/85aeL4H.png https://i.imgur.com/85aeL4H.png

Just curious, is this restricted to Android only?

by walty8 8y ago

Just curious, is this restricted to Android only?

A lot of this is not possible in iOS, because it doesn’t allow drawing on top of alert type messages. The attacks relating to password managers are probably still relevant. Possibly so are the ones relating to accessibility, although I don’t think iOS allows accessibility controls access like Android does.

closeparen 8y ago
iOS doesn't allow apps to draw over other apps at all, AFAIK.
- saagarjha 8y ago
  * In some very specific cases apps can "draw" on top of other apps, namely though the "app extension" mechanism which is completely out-of-process and very tightly controlled (for example, apps have very limited ability to modify the context outside of the "rectangle" they render in).
chii 8y ago
So the question is whether the trade-off of accessibility capabilities worth the decrease in security?
- henvic 8y ago
  In general terms, iOS accessibility is far greater than Android's. I would say this is more akin to a feature than accessibility, in practical means...
  - saagarjha 8y ago
    iOS does accessibility natively and does not allow apps access to it to the extent that Android does, AFAIK.

on_and_off 8y ago

The "draw on top" hole is a known issue on Android that iOS does not share (since you can't do that on iOS afaik). Google has several time been tempted to just remove it but since many have legitimate use cases for it that are very popular (like facebook messaging bubble), it has been not been removed fully. Like it is mentioned in the talk, you need the 'draw on top' permission to do so. The caveat is that apps downloaded from the play store get it by default. From what I have seen, the talk seem to only talk about the doability of such an attack, not that it has been seen in the wild ? In theory, you could craft an app with a legitimate draw on top behavior + the malware one and get it published that way. The approval/rejection on the play store is very obscure though, so hard to get any more info on that. IIRC, Google has also added a "an app is drawing on top of the screen" permanent notification when an app does so, causing many people to be pissed at this 'useless' notification. ffs. iOS does have a11y capabilities as well, so there is that surface of attack, although I don't know if it is exploited.

sk0g 8y ago
I'm assuming the draw on top is through a specific API right? Why not have a section for (if you do use the feature) justifying why you need draw on top. Then have someone go over the source code to verify that the information volunteered matches up with what is going on behind the scenes. Or just decrypt APK and search for usages of the library? Also, why is such an intrusive feature enabled by default?! I want proper prompts explaining why they want it, and to be able to decide if I want to give them those permissions.
- iforgotpassword 8y ago
  > Then have someone go over the source code That someone is who exactly? Did you ever try to contact support for any google product and get more than some standard text blocks back? And that's just regular support people. For what you suggest you'd need an army of people literate in Java, reviewing any app with that permission, including every update, ever uploaded to the app store. The best way would be to just get rid of this feature, and then maybe look at what the most common use cases for it were and add a few APIs for those.
- 8y ago

geocar 8y ago

Apple doesn't support overdraw across apps, but there are still things Apple can learn here. Many system apps still use "insecure" dialogs that can (and are!) used to train users to do unsafe things. This[1] dialog can be drawn by an app (or injected using an advertisement!), and Apple ID failures are "common enough" that this works to collect people's Apple IDs. [1]: https://i.imgur.com/85aeL4H.png https://i.imgur.com/85aeL4H.png