Passwords should be invisible to the accessibility services

[mohammadnaseri]

Due to recent attacks, malicious apps that are using the accessibility service can capture all user inputs. In this case, the passwords should be ignored for the accessibility service, so such attacks cannot happen. This is done by our research project in CISPA, Saarland University, Germany.

[schildbach]

Thanks! Can you provide a link to your project?

If we disable accessibility services, how are disabled users going to enter their passwords and passphrases?

[ligi]

@mohammadnaseri I would also be very interested in more details about your project/research (kind of using this comment to subscribe to this issue :)

[mohammadnaseri]

It is a thesis project (between INRIA and CISPA) that is going to be submitted as a paper.
Basically, we created a tool that automatically flags the apps with such a vulnerability. We have proposed different solutions to this problem. From the developer's side, it is a trade-off that needs to be decided. On the other word, it is a quick fix till Android changes their architecture regarding the accessibility services which we have proposed to them as well. The thing is, we have already published an app in the play store and once it is installed on the phone, it can capture the entered password by apps with that vulnerability.

[schildbach]

Can you link to the app?

[mohammadnaseri]

Since it is an ongoing project, better not to present the app in the Github. Worth mentioning that the app is not malicious and just as a way to flag the apps with the vulnerability. At the end of the day, it is a trade-off that the developer needs to decide.

[ligi]

can you DM the app? Or when will the paper be released?

[mohammadnaseri]

End of August or September.

[ligi]

Does your paper describe how projects can address the problem when they use react native or some framework that renders to a webview?

[mohammadnaseri]

Yes, we have a separate discussion for that topic.

[tejado]

Thank you @mohammadnaseri . Where can I find the paper when it is released?

[mohammadnaseri]

You can check : https://cispa.saarland/research/publications/