Permissionless Universal Overlays

The talk begins with how Android composes app windows, covering the window manager, the surface compositor, and the Z-order of window types. It explains that some window types can be shown without visible user approval, and that certain flags let a window pass touches through to the window beneath it. These behaviours form the basis for the overlay, task hijacking and activity switching attacks that the speaker groups together.

The middle of the talk reviews earlier research, including toast-based overlays and a malware family that abused a presentation window type to start activities from the background. The main research shows that users cannot tell which app they are using when activities stack on top of each other. Combined with click-through windows, an attacker can cover system permission dialogs and effectively approve sensitive permissions such as SMS, call logs and device administration without the user noticing. A multi-step variant relies on a predictable app list order and a trampoline activity to reach deeper settings screens. Demonstrations show a test app moving from no granted permissions to several.

The closing section covers defenses. The speaker points to the obscured-touch check Android uses for its own dialogs, which discards input when a window is partly covered. He also notes the hide-overlay-windows permission added in later versions, which guards against toast and alert overlays but not this technique. A practitioner should take away that permission prompts alone do not protect users when another app can draw over them.