'Cloak & Dagger' attack hits all the typical Android security weaknesses

The Android security team repeatedly deemed the attacks less severe than the researchers did.

Hackers can use a malicious app to secretly take over and spy on an Android device with a new series of attacks dubbed Cloak & Dagger, according to research published recently at the IEEE Symposium on Security and Privacy.

“The possible attacks include advanced clickjacking, unconstrained keystroke recording, stealthy phishing, the silent installation of a God-mode app (with all permissions enabled), and silent phone unlocking and arbitrary actions (while keeping the screen off),” the researchers explained.

A study of 20 users showed the attacks are practical and virtually undetectable. They were disclosed to Google beginning in August 2016 and remain partially actionable today because, according to the account given by the researchers, the Android security team repeatedly deemed the attacks less severe than the researchers did.

Android’s security team did not respond to CyberScoop’s request for a comment.

“A quick experiment shows that it is trivial to get such [a malicious] app accepted on the Google Play Store,” the researchers wrote.

Malicious apps are a real threat on the Google Play store. Last month, researchers found spyware that had been downloaded over 1 million times in the three years it had been sitting on the Play store. A few days earlier, bank malware masqueraded in similar fashion as an innocent “Funny Videos” app that was downloaded over 5,000 times.

The Cloak & Dagger researchers explained how they got on the Google Play store: “In particular, we submitted an app requiring these two permissions and containing a non-obfuscated functionality to download and execute arbitrary code (attempting to simulate a clearly-malicious behavior): this app got approved after just a few hours (and it is still available on the Google Play Store).”

The series of attacks are numerous but all connected, because they allow attackers to surreptitiously gain two key permissions without any notification to the user.

The researchers recommend users check permissions on apps they use, a task that can be complicated or even impossible on some versions of Android.

Here is one attack demonstrated:

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems