HexBrain

Faceless · Report #17766

Tap Jacking Attack on Button Tags

Validstatus
2upvotes
7 Jul 2014disclosed

How it was found

UI Redressing (Tap jacking) attack may trick users into tapping a specifically crafted malicious App popup window (e.g. toast view), making it a gateway for varied threats such as framing attack. Using this technique, a malicious App could potentially trick a user into making purchases, clicking on ads, installing Apps, or even wiping all of the data from the phone.

Button Tags in the layout folder they need to be protect with an attribute "filterTouchesWhenObscured='true".

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original