Gmail Is One Of The Most Vulnerable Apps To Hackers In Android: Report
Android has been continuously targeted by hackers since the launch of its very first version. Being an open-source project unlike iOS, Android offers great opportunities for the researchers to enhance its capabilities and make it more secure. To our disappointment, iOS, however, has managed to become much more secure than Android, despite of not being an open-source project.
We have seen researchers uncovering security flaws in Android framework and Google providing their solution in next updates. Recently, there was a story about how Android smartphones were vulnerable to security attacks because of a feature in Android that could be exploited to leak location history.
Another flaw about “Factory Reset” option in Android was detected by a team of researchers from Avast that showed that factory reset option didn’t actually wipe data completely off the smartphone. It could be recovered later by the future buyer revealing all embarrassing photos users ever took and their contacts as well.
Now, a team of researchers from University of Michigan and University of California at Riverside has uncovered another exploit in Android design that gives way to the hackers. According to their study, Gmail accounts can be hacked with a 92% success rate using the technique uncovered by the researchers.
Here is how it works. User downloads a malicious but seemingly harmless app that runs in a background. It could be a wallpaper or any other app. Then this app, while it runs in the background, monitors a feature in Android called “Shared Memory” to figure out user’s activity on the smartphone.
Now when the attacker knows what user is doing, just as the user is about to open a page in app like Gmail to enter the login credentials, the attacker would make the operating system display a similar page. User would enter credentials thinking that they are being used to log in to the account but the credentials would be read by the attacker. In technical language, this is done by monitoring app’s UI state.
The technique can be used to hack Gmail with a 92% success rate while Newegg, WebMD, Chase Bank and Hotels.com can be hacked with 80-90% success rate, as shown in the study. H&R Block app was also hacked with their technique that succeeded 92% of the time whereas Amazon app was the most difficult to crack with 48% success rate.
The researchers have published three videos demonstrating the technique used to hack into the apps. The videos show how this technique can be used to hack user’s social security number, credit card information, and other login credentials from the vulnerable apps. Their work was published at USENIX Security Symposium in San Diego.
Note that shared memory feature is used in almost all operating systems including iOS and Windwos as well. Researchers are confident that their exploit would work the same on other platforms as it did on Android.
They have suggested some design techniques that could be used in Android to avoid such attacks. We hope Google finds a workaround for such vulnerabilities in its future releases.