3 ms·

That the app does not require permissions is the notable bit here. I do not know the mobile system, but I thought apps were supposed to be firewalled from each

That the app does not require permissions is the notable bit here. I do not know the mobile system, but I thought apps were supposed to be firewalled from each other unless given explicit grants. The obvious joke, how long has Facebook been using this exploit?

OgsyedIE 1y ago
Several preinstalled bloatware stores such as Galaxy Store, Moto apps and so forth will default to opt-in to automatically installing 'recommended apps and games' - essentially spyware garbage they get kickbacks from - in the background, plus several flagship phones now come with Temu preinstalled. The 90% of non technically-savvy Android users are 100% exposed to the OP exploit.
- AmbroseBierce 1y ago
  The app needs to be opened by the user for the exploit to work, as seen in the video the researchers published, so the surface attack is big but not that big.
  - rkagerer 1y ago
    I have definitely opened the wrong app by accident on a smartphone - super easy to tap the wrong thing in a variety of situations (grasping at an awkward angle to snap a photo, pocket taps, etc).
- kelvinjps10 1y ago
  I recommend the program universal android debloater, it will uninstall all those apps
  - kotaKat 1y ago
    Unless the manufacturer has placed their malware loader into the “nodisable” list. Motorola are assholes and now prevent you from using pm to disable any of their malware loader apps on most of their phones.
autoexec 1y ago
> That the app does not require permissions is the notable bit here. The article mentions that "the attacker renders something transparent in front of the target app". I would have thought that sort of thing would require the "appear on top" permission.
- SoftTalker 1y ago
  This sounds like a trick I read about years ago. Disappointing if it hasn’t been fixed.
hulitu 1y ago
> The obvious joke, how long has Facebook been using this exploit? They were caught exfiltrating data fron phones, with no visible Facebook app installed, only the background one.

OgsyedIE 1y ago

Several preinstalled bloatware stores such as Galaxy Store, Moto apps and so forth will default to opt-in to automatically installing 'recommended apps and games' - essentially spyware garbage they get kickbacks from - in the background, plus several flagship phones now come with Temu preinstalled. The 90% of non technically-savvy Android users are 100% exposed to the OP exploit.

AmbroseBierce 1y ago
The app needs to be opened by the user for the exploit to work, as seen in the video the researchers published, so the surface attack is big but not that big.
- rkagerer 1y ago
  I have definitely opened the wrong app by accident on a smartphone - super easy to tap the wrong thing in a variety of situations (grasping at an awkward angle to snap a photo, pocket taps, etc).
kelvinjps10 1y ago
I recommend the program universal android debloater, it will uninstall all those apps
- kotaKat 1y ago
  Unless the manufacturer has placed their malware loader into the “nodisable” list. Motorola are assholes and now prevent you from using pm to disable any of their malware loader apps on most of their phones.

autoexec 1y ago

> That the app does not require permissions is the notable bit here. The article mentions that "the attacker renders something transparent in front of the target app". I would have thought that sort of thing would require the "appear on top" permission.

SoftTalker 1y ago
This sounds like a trick I read about years ago. Disappointing if it hasn’t been fixed.

hulitu 1y ago

> The obvious joke, how long has Facebook been using this exploit? They were caught exfiltrating data fron phones, with no visible Facebook app installed, only the background one.