Overview

Overlay attacks (also known as tapjacking) allow malicious apps to place deceptive UI elements over a legitimate app's interface, potentially tricking users into performing unintended actions such as granting permissions, revealing credentials, or authorizing payments. If the app does not implement appropriate protections, users can interact with overlaid malicious content while believing they are interacting with the legitimate app.

Android provides several mechanisms to protect against overlay attacks through touch filtering. These mechanisms can detect when a view is obscured and filter touch events accordingly. However, if the app does not use these protections on sensitive UI elements, it remains vulnerable to overlay attacks.

This test checks whether the app implements overlay attack protections by looking for references to touch filtering APIs and attributes that prevent interaction when views are obscured.

These include:

Steps

  1. Use MASTG-TECH-0013 to reverse engineer the app.
  2. Use MASTG-TECH-0014 to look for the relevant APIs.
  3. Use MASTG-TECH-0117 to obtain the AndroidManifest.xml.
  4. Use MASTG-TECH-0150 to obtain the targetSdkVersion from the AndroidManifest.xml file.
  5. Use MASTG-TECH-0126 to obtain the relevant permissions.

Observation

The output should contain:

Evaluation

The test fails if the app handles sensitive user interactions (such as login, payment confirmation, permission requests, or security settings) and does not implement any overlay attack protections on those sensitive UI elements.

For example:

Свързани задачи

Връзки
is related to MASTG-BEST-0040 Preventing Overlay Attacks (Android)