Incident: Cloak & Dagger Android Vulnerability Exposes Users to Attacks

Published Date: 2017-07-27

Postmortem Analysis
Timeline 1. The software failure incident detailed in the article happened in May [61286]. Therefore, the software failure incident occurred in May 2017.
System 1. Android operating system versions up to 7.1.2 2. Android permissions SYSTEM_ALERT_WINDOW and BIND_ACCESSIBILITY_SERVICE 3. Google Play Protect 4. Google Play Store 5. Cloak & Dagger attack methods 6. User interface design and features of Android 7. Backward compatibility mechanisms in Android 8. Overlays and visual elements manipulation in Android 9. Accessibility services in Android 10. Fragmented version adoption of Android [Cite: <Article 61286>]
Responsible Organization 1. Researchers at the Georgia Institute of Technology and University of California, Santa Barbara [61286]
Impacted Organization 1. Android users were impacted by the software failure incident detailed in the article [61286].
Software Causes 1. User interface bugs in Android operating system allowed for the Cloak & Dagger attack to manipulate attributes of the visual design and user interface, leading to hiding malicious activity [61286].
Non-software Causes 1. Lack of user awareness and approval for permissions requested by malicious apps [61286] 2. Exploitation of human behavior through social engineering tactics like bait and switch [61286]
Impacts 1. The software failure incident known as Cloak & Dagger allowed attackers to hide malicious activity by manipulating attributes of the operating system's visual design and user interface, potentially exposing virtually all Android users to insidious attacks [61286]. 2. The main Cloak & Dagger attacks affected all recent versions of Android, up to the current 7.1.2, exploiting Android permissions like SYSTEM_ALERT_WINDOW and BIND_ACCESSIBILITY_SERVICE to track, query, and manipulate visual elements on the phone [61286]. 3. The attackers could abuse the accessibility permission granted by users to perform keystroke logging, phishing, stealthy installation of malicious apps, and simulate user behavior, leading to potential system takeovers [61286]. 4. Google's efforts to address the vulnerabilities through updates like Google Play Protect were not completely effective due to the distributed nature of the attacks and the numerous variations developed by the researchers, indicating that the patchwork of vulnerabilities may persist for a long time due to Android's fragmented version adoption [61286].
Preventions 1. Regular security audits and testing of the Android operating system to identify and address vulnerabilities before they can be exploited [61286]. 2. Implementing stricter permission controls for sensitive permissions like SYSTEM_ALERT_WINDOW and BIND_ACCESSIBILITY_SERVICE to prevent malicious apps from abusing them [61286]. 3. Enhancing user awareness and education on granting permissions to apps, especially when it involves sensitive functionalities that can be exploited by malicious actors [61286].
Fixes 1. Updating to the upcoming Android O release, which addresses many of the bugs related to the Cloak & Dagger attack [61286]. 2. Utilizing Google Play Protect, Google's security services on all Android devices with Google Play, to detect and prevent the installation of malicious apps exploiting the vulnerabilities [61286]. 3. Implementing stricter approval processes for permissions like SYSTEM_ALERT_WINDOW and BIND_ACCESSIBILITY_SERVICE to prevent malicious apps from gaining access to sensitive functionalities [61286].
References 1. Researchers at the Georgia Institute of Technology and University of California, Santa Barbara [61286] 2. Google spokesperson [61286]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to the Cloak & Dagger attack has happened again within the same organization, Google. The vulnerabilities detailed by researchers at the Georgia Institute of Technology and University of California, Santa Barbara have been worked on with Google to address them. Google has addressed many of the bugs in its upcoming Android O release, but the methods persist on current versions of Android, potentially exposing virtually all Android users to the attack [61286]. (b) The Cloak & Dagger attack, which manipulates attributes of the operating system’s visual design and user interface to hide malicious activity, has affected all recent versions of Android, up to the current 7.1.2. This incident highlights a vulnerability that potentially impacts virtually all Android users, indicating that similar incidents could happen with other organizations or their products and services that rely on Android systems [61286].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase is evident in the Cloak & Dagger attack detailed in the article [61286]. The attack manipulates attributes of the operating system's visual design and user interface to hide malicious activity. This vulnerability stems from unintended consequences of features working the way they're supposed to, making it difficult to resolve as the potentially impacted feature has an important, legitimate use. The vulnerabilities persist on current versions of Android, potentially exposing virtually all Android users to the attack. The design flaws in the Android system's visual design and user interface allowed for the exploitation of these vulnerabilities. (b) The software failure incident related to the operation phase is also highlighted in the same article [61286]. The Cloak & Dagger attack takes advantage of two Android permissions, SYSTEM_ALERT_WINDOW, and BIND_ACCESSIBILITY_SERVICE, which allow apps to display overlay screens and track visual elements displayed on the phone, respectively. Malicious apps can exploit these permissions to hide ill-intentioned activity behind innocuous-looking screens, tricking users into granting permissions unknowingly. This misuse of permissions during the operation of the system enables the attackers to carry out keystroke logging, phishing, and stealthy installation of other malicious apps, showcasing the operational vulnerabilities in the Android system.
Boundary (Internal/External) within_system (a) The software failure incident related to the Cloak & Dagger attack on Android devices can be categorized as within_system. The vulnerabilities exploited in this attack stem from within the Android operating system itself, specifically related to user interface bugs and permissions granted to apps [61286]. The attack manipulates attributes of the operating system's visual design and user interface to hide malicious activity, taking advantage of Android permissions like SYSTEM_ALERT_WINDOW and BIND_ACCESSIBILITY_SERVICE [61286]. The difficulty in resolving these vulnerabilities lies in the fact that they are inherent to the system and changing them could lead to backward compatibility issues [61286].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the articles is primarily due to non-human actions, specifically vulnerabilities in the Android operating system that were exploited by the Cloak & Dagger attack. These vulnerabilities were not introduced by human actions but were inherent in the design and functionality of the Android system. The attack manipulated attributes of the operating system's visual design and user interface to hide malicious activity, taking advantage of permissions like SYSTEM_ALERT_WINDOW and BIND_ACCESSIBILITY_SERVICE [61286]. (b) However, human actions also play a role in this software failure incident as the researchers identified and detailed the vulnerabilities in the Android system. Additionally, the attackers who exploit these vulnerabilities through the Cloak & Dagger attack are humans who intentionally manipulate the system for malicious purposes [61286].
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware: The Cloak & Dagger attack detailed in the article [61286] manipulates attributes of the operating system's visual design and user interface to hide malicious activity. This attack takes advantage of two Android permissions, one of which is the SYSTEM_ALERT_WINDOW permission that allows apps to display overlay screens for notifications. These permissions can be abused to hide ill-intentioned activity behind innocuous-looking screens, exploiting vulnerabilities in the hardware-related features of the Android operating system. (b) The software failure incident related to software: The Cloak & Dagger attack is a software vulnerability that affects all recent versions of Android, up to the current 7.1.2. It exploits software vulnerabilities in the Android operating system related to permissions like SYSTEM_ALERT_WINDOW and BIND_ACCESSIBILITY_SERVICE. These vulnerabilities allow malicious apps to manipulate overlays, track objects on the screen, interact with them, and even simulate user behavior to carry out malicious activities.
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the article is malicious in nature. It involves an attack known as Cloak & Dagger, which manipulates attributes of the operating system's visual design and user interface to hide malicious activity. The attack takes advantage of vulnerabilities in Android permissions, such as SYSTEM_ALERT_WINDOW and BIND_ACCESSIBILITY_SERVICE, to carry out malicious actions like keystroke logging, phishing, and stealthy installation of other malicious apps [61286]. The attackers exploit these permissions to simulate user behavior and gain deeper access to the victim system, demonstrating a clear intent to harm the system. (b) The software failure incident is not non-malicious as it involves intentional exploitation of vulnerabilities in the Android system to carry out harmful activities.
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The intent of the software failure incident related to poor_decisions: - The software failure incident related to the Cloak & Dagger attack on Android devices can be attributed to poor decisions made in the design and implementation of the Android operating system's visual design and user interface features. These vulnerabilities were not accidental but rather a result of decisions that allowed for the exploitation of user interface bugs for malicious activities [61286]. (b) The intent of the software failure incident related to accidental_decisions: - The software failure incident also involved accidental decisions or unintended consequences of features working as intended. The vulnerabilities in the Android operating system were not solely due to accidental mistakes but also stemmed from the unintended consequences of features that were designed to have legitimate uses but could be manipulated for malicious purposes [61286].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the Cloak & Dagger attack on Android devices. The vulnerabilities exploited in this attack were not just accidental flaws but also stemmed from unintended consequences of features working as intended. The researchers highlighted that these user interface bugs are out there and can be easily exploited, making them a significant challenge to fix due to backward compatibility issues [61286]. (b) The software failure incident also involved accidental factors as the vulnerabilities in Android's permissions, such as SYSTEM_ALERT_WINDOW and BIND_ACCESSIBILITY_SERVICE, were being exploited by malicious apps to hide ill-intentioned activities behind innocuous-looking screens. Users were tricked into accepting permissions that could then be abused for keystroke logging, phishing, and stealthy installation of other malicious apps. This type of bait-and-switch tactic is a form of click-jacking, showcasing how accidental factors can lead to software failures [61286].
Duration temporary The software failure incident described in the article is more aligned with a temporary failure rather than a permanent one. The vulnerabilities in the Cloak & Dagger attack were identified by researchers and have been worked on with Google to address them. Google has made efforts to address many of the bugs in its upcoming Android O release, indicating a temporary nature of the failure incident [61286]. However, the article also mentions that due to the fragmented version adoption of Android, the patchwork of remaining vulnerabilities will likely persist for a long time, suggesting a more prolonged impact, which could lean towards a semi-permanent state [61286].
Behaviour value, other (a) crash: The software failure incident described in the article does not involve a crash where the system loses state and does not perform any of its intended functions. Instead, it focuses on vulnerabilities in the Android operating system that allow for malicious activities to be hidden behind innocent-looking screens [61286]. (b) omission: The incident does not involve a failure due to the system omitting to perform its intended functions at an instance(s). It primarily revolves around exploiting permissions in the Android system to carry out malicious activities [61286]. (c) timing: The failure is not related to the system performing its intended functions too late or too early. It is more about the exploitation of permissions and features in the Android system to conduct malicious activities [61286]. (d) value: The software failure incident is related to the system performing its intended functions incorrectly. Specifically, it involves manipulating attributes of the operating system's visual design and user interface to hide malicious activity, exploiting permissions like SYSTEM_ALERT_WINDOW and BIND_ACCESSIBILITY_SERVICE [61286]. (e) byzantine: The incident does not involve the system behaving erroneously with inconsistent responses and interactions. It is more focused on exploiting vulnerabilities in the Android system to carry out stealthy attacks [61286]. (f) other: The behavior of the software failure incident can be categorized as a security vulnerability that allows for the manipulation of permissions and features in the Android system to conduct malicious activities. It involves a sophisticated attack known as Cloak & Dagger, which takes advantage of user interface bugs and permissions to hide malicious behavior [61286].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (a) unknown (b) unknown (c) unknown (d) [61286] The software failure incident related to the Cloak & Dagger attack on Android devices did not directly result in physical harm or loss of life. However, it did impact people's material goods and data as malicious apps could potentially steal sensitive information or install other harmful software on the victims' devices. This could lead to financial losses or privacy breaches for the affected users.
Domain information (a) The software failure incident discussed in the article is related to the security vulnerabilities in Android operating systems, affecting virtually all Android users [Article 61286]. This incident falls under the information industry as it involves the manipulation of attributes of the operating system's visual design and user interface to hide malicious activity, potentially impacting the production and distribution of information.

Sources

Back to List