5 ms·

Demo: Android 14 Clipboard Manager Data Leak Security Issue

66 points by KeshiaRose 3y ago

BoorishBears 3y ago
[flagged]
iamcalledrob 3y ago
Hopefully a relatively easy fix on the OS side: ensure that these toasts have a higher z-index than app overlay windows. Sidenote: I really hope Android doesn't lose the ability to do things like these overlay windows. These types of "power user" features are often where innovation happens. It makes me sad when flexible general purpose APIs are replaced with locked down, specific ones. (e.g. overlay windows API -> a specific "chat heads" API). The new APIs might be fine for current use cases, but ensure that innovation terminates at whatever th OS vendor designed.
- jeroenhd 3y ago
  > Hopefully a relatively easy fix on the OS side: ensure that these toasts have a higher z-index than app overlay windows. The point of the system overlay permission is to draw on top of everything else. Maybe Android should introduce some kind of overlay overlay overlay to overlay clipboard messages, but I think that would probably overcomplicate the API. Perhaps it's better to instead send a notification when an application rendering a system overlay accesses the clipboard as well. That way, users closing out of the app can see that the application has accessed the clipboard. Of course sufficiently privileged applications can dismiss notifications, but that requires even more difficult to attain permissions.
  - _ea1k 3y ago
    I think this makes a good case for something in between that can display the annoying popup chat bubbles, but can't override toasts.
  - danmur 3y ago
    An overlay buster buster
  - xinayder 3y ago
    Or just make it so the system-wide Toast cannot be overdrawn, it will always stay on top.
- debatem1 3y ago
  > It makes me sad when flexible general purpose APIs are replaced with locked down, specific ones. (e.g. overlay windows API -> a specific "chat heads" API). Doesn't have to be a replacement. It's good when you add specific APIs to do specific things that aren't very dangerous and then have the super dangerous one left as a risk signal. Innovation can still happen, common things get easier, and dangerous things get rarer. Feels pretty good to me.
- deleted 3y ago
  [deleted]
jeroenhd 3y ago
I can see the issue, but SYSTEM_ALERT_WINDOW isn't a permission you'd normally give to an app. You can probably trick some users into giving that permission, but it's not easy and Google Play will probably kick your app out of the Play Store if you try to use it in the first place. Abuse from system apps is a potential threat but you can't really do much about those. System apps can bypass all manners of restrictions, I'm not sure if clipboard access is something to be particularly worried about when system apps can already read your entire SD card and bypass app firewalls/VPNs.
kelnos 3y ago
Unless I'm misreading this, it sounds like an app can only suppress the clipboard paste toast if either: 1) It's a system app, and thus has permission to "legally" suppress the notification. This can be a problem for pre-installed third-party apps. But if your phone doesn't have those, you're fine. (More or less; I don't love the idea that system apps can suppress the notification, period.) 2) It's an app that you've explicitly granted permission to draw over top of other apps. Which is a permission that's hard to accidentally grant, and is a permission that you shouldn't grant to any app, unless you super super super super trust it. Seems like kinda a nothingburger?
- jwells89 3y ago
  The first scenario is a possibility for a lot of budget phones, as well as carrier-distributed phones. Both include bundled third party "system" apps, especially the budget phones where the bundleware is more likely to be from questionable devs. It's something most of us knew already, but it's just another reason why it's a bad idea to buy dirt cheap crapware-subsidized phones, and why it's better to buy phones through electronics retailers or from the manufacturer and to steer clear of purchasing through carriers.
  - lolinder 3y ago
    If the main attack vector is "software preinstalled by shady manufacturers", I'd still file that under "nothingburger". There are many, many ways for shady manufacturers to do shady things with their OEM version of Android, and this is far from a game changer for them.
- timenova 3y ago
  Drawing over other apps is a problem too. On my OnePlus, I just checked, there are 23 apps with the permission to draw over other apps, but only 3 of those are the ones I've explicitly allowed. 20/23 apps are Google, OnePlus, or Android System apps. I never knew so many of them had this permission!
  - KRAKRISMOTT 3y ago
bpeebles 3y ago
It seems like nothing changes in Android 14? Like at worst it's still possible on 14, whatever it is, but my impression from the title was that it's a new issue with 14 making me think I should delay updating.
batch12 3y ago
I wish there was a way to view apps by permission- so I wouldn't have to audit every app individually. Is this possible?
- Georgelemental 3y ago
  Settings > Privacy > Permission manager Settings > Apps > Special app access

66 points by KeshiaRose 3y ago

[flagged]

Hopefully a relatively easy fix on the OS side: ensure that these toasts have a higher z-index than app overlay windows. Sidenote: I really hope Android doesn't lose the ability to do things like these overlay windows. These types of "power user" features are often where innovation happens. It makes me sad when flexible general purpose APIs are replaced with locked down, specific ones. (e.g. overlay windows API -> a specific "chat heads" API). The new APIs might be fine for current use cases, but ensure that innovation terminates at whatever th OS vendor designed.

jeroenhd 3y ago
> Hopefully a relatively easy fix on the OS side: ensure that these toasts have a higher z-index than app overlay windows. The point of the system overlay permission is to draw on top of everything else. Maybe Android should introduce some kind of overlay overlay overlay to overlay clipboard messages, but I think that would probably overcomplicate the API. Perhaps it's better to instead send a notification when an application rendering a system overlay accesses the clipboard as well. That way, users closing out of the app can see that the application has accessed the clipboard. Of course sufficiently privileged applications can dismiss notifications, but that requires even more difficult to attain permissions.
- _ea1k 3y ago
  I think this makes a good case for something in between that can display the annoying popup chat bubbles, but can't override toasts.
- danmur 3y ago
  An overlay buster buster
- xinayder 3y ago
  Or just make it so the system-wide Toast cannot be overdrawn, it will always stay on top.
debatem1 3y ago
> It makes me sad when flexible general purpose APIs are replaced with locked down, specific ones. (e.g. overlay windows API -> a specific "chat heads" API). Doesn't have to be a replacement. It's good when you add specific APIs to do specific things that aren't very dangerous and then have the super dangerous one left as a risk signal. Innovation can still happen, common things get easier, and dangerous things get rarer. Feels pretty good to me.
deleted 3y ago
[deleted]

jeroenhd 3y ago

I can see the issue, but SYSTEM_ALERT_WINDOW isn't a permission you'd normally give to an app. You can probably trick some users into giving that permission, but it's not easy and Google Play will probably kick your app out of the Play Store if you try to use it in the first place. Abuse from system apps is a potential threat but you can't really do much about those. System apps can bypass all manners of restrictions, I'm not sure if clipboard access is something to be particularly worried about when system apps can already read your entire SD card and bypass app firewalls/VPNs.

kelnos 3y ago

Unless I'm misreading this, it sounds like an app can only suppress the clipboard paste toast if either: 1) It's a system app, and thus has permission to "legally" suppress the notification. This can be a problem for pre-installed third-party apps. But if your phone doesn't have those, you're fine. (More or less; I don't love the idea that system apps can suppress the notification, period.) 2) It's an app that you've explicitly granted permission to draw over top of other apps. Which is a permission that's hard to accidentally grant, and is a permission that you shouldn't grant to any app, unless you super super super super trust it. Seems like kinda a nothingburger?

jwells89 3y ago
The first scenario is a possibility for a lot of budget phones, as well as carrier-distributed phones. Both include bundled third party "system" apps, especially the budget phones where the bundleware is more likely to be from questionable devs. It's something most of us knew already, but it's just another reason why it's a bad idea to buy dirt cheap crapware-subsidized phones, and why it's better to buy phones through electronics retailers or from the manufacturer and to steer clear of purchasing through carriers.
- lolinder 3y ago
  If the main attack vector is "software preinstalled by shady manufacturers", I'd still file that under "nothingburger". There are many, many ways for shady manufacturers to do shady things with their OEM version of Android, and this is far from a game changer for them.
timenova 3y ago
Drawing over other apps is a problem too. On my OnePlus, I just checked, there are 23 apps with the permission to draw over other apps, but only 3 of those are the ones I've explicitly allowed. 20/23 apps are Google, OnePlus, or Android System apps. I never knew so many of them had this permission!
- KRAKRISMOTT 3y ago

bpeebles 3y ago

It seems like nothing changes in Android 14? Like at worst it's still possible on 14, whatever it is, but my impression from the title was that it's a new issue with 14 making me think I should delay updating.

batch12 3y ago

I wish there was a way to view apps by permission- so I wouldn't have to audit every app individually. Is this possible?

Georgelemental 3y ago
Settings > Privacy > Permission manager Settings > Apps > Special app access