Massive Android vulnerability discovered, hackers can control your phone remotely

Researchers from UC Santa Barbara and Georgia Tech have found a new type of Android attacks, called Cloak and Dagger that operates secretly on the smartphone, allowing hackers to log keystrokes or install malicious softwares without alarming the owner.

Cloak and Dagger takes advantage of the Android UI and they need just two permissions to get rolling: SYSTEM ALERT WINDOW ("draw on top") and BIND ACCESSIBILITY SERVICE ("a11y"). This concerns researchers because Android OS automatically grants these permissions for any app from the Play Store, meaning once a hacker is in the system, it is possible to trick the user into granting the a11y permission.

A Cloak and Dagger-enabled app hides a layer of malicious activity under seemingly harmless visuals, luring users to click on unseen buttons and keystroke loggers.

"To make things worse, we noticed that the accessibility app can inject the events, unlock the phone, and interact with any other app while the phone screen remains off," the researchers write. "That is, an attacker can perform a series of malicious operations with the screen completely off and, at the end, it can lock the phone back, leaving the user completely in the dark."

One of the researchers, Yanick Fratantonio, told TechCrunch, "We've been in close touch with the researchers and, as always, we appreciate their efforts to help keep our users safer," a spokesperson says. "We have updated Google Play Protect -- our security services on all Android devices with Google Play -- to detect and prevent the installation of these apps. Prior to this report, we had already built new security protections into Android O that will further strengthen our protection from these issues, moving forward."