Best practices for shielding mobile apps from emerging threats
summary
Demonstrates a working exploit that uses Android accessibility services to scan accessibility node info, inject clicks, read SMS and capture typed passwords; a Python bot automates taps and evades simple heuristics by randomizing pixels. Research of top 100 financial apps finds only 8% defend against accessibility attacks. Mitigations tested: marking views not important (bypassable), hooking views and nulling accessibility info (recommended but caused crashes on Android 7), and detecting injected events via type virtual input.
AI-written summary · about
chapters (12)
- 0:00Introduction and speaker background
- 1:55What is app shielding
- 2:16Accessibility services overview
- 3:20Research findings on financial apps
- 4:23Demonstration of accessibility attack
- 5:30Screen reading and data logging risks
- 6:45Social engineering tactics
- 7:48Innocent feature promises
- 8:52Rooting and shell command exploitation
- 9:34Game bot and bypass techniques
- 11:00Protection methods against attacks
- 12:45Detecting injected inputs
related talks
34mWhen Accessibility Uses Us Back — Attacks and Defenses Involving Malware and Accessibility
32mExploring Android Accessibility Malware
28mExploring Android Accessibility Malware
40mBest practices for shielding mobile apps from emerging threats
20mExploring Android Accessibility Malware
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
22mBest practices for shielding mobile apps from emerging threats
21mWhen Attackers Go Mobile-First: What Developers Need to Know