How to Block Overlay Attacks on Android Apps

What is an Overlay Attack?

Here are the Top 3 Ways Hackers Use Screen Overlay Attacks in Mobile Fraud

• Data Theft/ Data Harvesting
  • In banking and finance apps, one common screen overlay technique is where the attacker creates a fake copy of the bank’s UI (such as a login screen), and places it on top of the user’s screen. The most common interaction pattern for this attack would be tricking the user to enter information such as account numbers, credit card info, ATM pin codes, username, password, API Keys, app secrets, security questions, etc. When the user types the information requested, they are actually transmitting the data through the fake overlay window, which is controlled by the attacker.

• Infiltration and Malware Delivery
  • The attacker might also use a Screen Overlay attack to create a backdoor for themselves that they can use to deliver malware onto a mobile device. For example, Android Allow Unknown Sources is an Android OS setting that allows a user to install apps outside of Google Play, or programs that may not be trusted or known to be safe. As part of the overlay attack, the hacker tricks the user into enabling Allow Unknown Sources by superimposing a fake button on top of the button that enables Unknown Sources and tricking the user into clicking on it. They can then use that channel as a vehicle to get fake apps or malware updates onto the device.

• Privilege Escalation
  • Hackers also use overlay attacks to trick users into elevating administrative privileges or enabling functions that allow the hacker to control an app or device remotely. For example, in a common overlay attack variant, the hacker tricks the mobile user into enabling Android AccessibilityServices. AccessibilityServices are OS-level settings in Android that are designed to help users with disabilities (eg: screen readers, speech to text, touch events). They run in the background and receive callbacks by the system when accessibility events are fired, making them capable of reacting to a state transition in the UI (eg: focus has changed, button was clicked, or content in the active window was queried). These services also typically run with a higher level of administrative privilege. For this reason, AccessibilityServices are often used for different purposes for which they were not intended and targeted by hackers to exploit. When abused, they are used to perform click actions (either to commit click fraud or to cheat in mobile games), read and write SMS messages and emails, intercept and read Two-Factor Authentication codes, steal cryptocurrency keys, control mobile devices or apps remotely and more.