"A new attack method demonstrated by researchers could lead to the theft of two-factor authentication (2FA) codes and more on Android devices. The attack technique, detailed in a paper titled Pixnapping: Bringing Pixel Stealing out of the Stone Age (PDF), has been developed by researchers from the University of California, Berkeley, San Diego, Washington, and Carnegie Mellon. Dubbed "Pixnapping," this attack vector begins when a victim unknowingly installs a malicious mobile application on their Android smartphone."
"Notably, the app doesn't need to abuse permissions to perform this attack, which exploits existing Android APIs, pixel rendering, and a hardware side channel. There are three steps to Pixnapping, so-called due to its abuse of pixels rendered by a target app, such as Google Authenticator. The first stage requires the malicious app to invoke a target app and make a system call to prompt the submission of sensitive data to the Android rendering pipeline."
Researchers developed Pixnapping, a side-channel technique that can extract sensitive information displayed on Android devices, including two-factor authentication codes. The attack requires only a malicious app installation and does not need to request special permissions. Pixnapping abuses Android rendering APIs, pixel rendering behavior, and a hardware side channel. The attack proceeds in stages: invoking a target app to render sensitive data, launching a semi-transparent layer to induce graphical operations and isolate pixels, then masking and enlarging pixels to determine their graphical content. A partial patch exists, with a more complete fix scheduled for December.
Read at ZDNET
Unable to calculate read time
Collection
[
|
...
]