When Accessibility Uses Us Back — Attacks and Defenses Involving Malware and Accessibility
summary
Demonstrates how Android banking trojans have abused AccessibilityService since 2020 to read masked passwords, capture credentials and auto-initiate transfers, using a proof‑of‑concept app. Describes a Play Store bypass using ZIP header asymmetry, a social‑engineering flow to obtain accessibility permissions, and delivery of payloads via an in‑memory DEX loader to evade Play Protect, and lists defenses such as filterTouchesWhenObscured, the AccessibilityDataSensitive flag, stricter vetting of assistive apps, and multi‑factor/risk‑based authentication.
AI-written summary · about
chapters (8)
- 0:00Accessibility service attacks
- 1:46How accessibility works
- 8:59Malware exploiting accessibility
- 16:48Live demo: accessibility malware
- 19:23Evading detection
- 23:00Defensive strategies
- 27:15Security trade-offs
- 31:16Summary
related talks
32mExploring Android Accessibility Malware
28mExploring Android Accessibility Malware
20mExploring Android Accessibility Malware
15mBest practices for shielding mobile apps from emerging threats
26mAccessibility Service Malwares
32mHacking the Hackers’ Code: Inside Android Malware
24mRecent Mobile App Security Incidents from Real-World Cases
42mThe Ways Hackers Are Taking To Win The Mobile Malware Battle