Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pixnapping Attack

pixnapping.com

Post reply on HN
Print view View original

61–70 of 75 posts

Re: Pixnapping Attack

#61

Post by tabbott »

In my view, the core issue here is that Android's permissions system doesn't consider "Running in the background" and "Accessing the Internet" to be things that apps need to ask the user for permission and the user can restrict.

This attack wouldn't work if every app, even an "offline game", has those implicit permissions by default. Many apps should at most have "Only while using the app" permission to access the Internet. Which would not be complete protection -- there's always the risk you misclick on a now-malicious app that you never use -- but it would make the attack far less effective.

Re: Pixnapping Attack

#62

Post by tabbott »

chias wrote: post #57
myfonj wrote: post #54

> I am an app developer. How do I protect my users? > We are not aware of mitigation strategies to protect apps against Pixnapping. If you have any insights into mitigations, please let us know and we will update this section. IDK, I think there are obvious low-hanging attempts [0] such as: do not display secret codes in stable position on screen? Hide it when in background? Move it around to make timing attacks diff…

Huh. I remember a while ago Google Authenticator hid TOTP codes until you tap on them to reveal them. I remember thinking this was an absolutely stupid feature, because it did not mitigate any real threat and was annoying and inconvenient. Apparently a lot of people agreed because a few weeks later, Google Authenticator quietly rolled that feature back. I wonder if they were aware of this flaw, and were mitigating th…

They could have made it a setting, with an explanation of the security benefits of it, so that folks who are paranoid can take advantage of it.

A relevant threat scenario is when you're using your phone in a public place. Modern cameras are good enough to read your phone screen from a distance, and it seems totally realistic that a hacked airport camera could email/password/2FA combinations when people log into sites from the airport.

Ideally, you want the workflow to be that you can copy the secret code and paste it, without the code as a whole ever appearing on your screen.

Re: Pixnapping Attack

#64

Post by kingforaday »

VGHN7XDuOXPAzol wrote: post #53
kingforaday wrote: post #31

Earlier quoted context omitted.

I wish Uber or Lyft allowed me to use a website. I hate having to find a regular taxi or rely on the kindness of others to use their app.

surprisingly, Uber does! m.uber.com is a mobile website for Uber. I only used once, in February, so hopefully they didn't break it since then.

Thanks. Will try it!

Re: Pixnapping Attack

#65

Post by zaruvi »

Don't extra security measures in authenticator apps provide protection against this? I need to enter a pin/fingerprint in order to access my codes. And the code of an entry is hidden and only temporarily shown after being tapped.

Re: Pixnapping Attack

#68

Post by efreak »

x0x0 wrote: post #58
noname120 wrote: post #36

Note that for TOTP the attack is only feasible if the font and pixel-perfect positions on the screen are known: > The attacks described in Section 5 take hours to steal sensitive screen regions—placing certain categories of ephemeral secrets out of reach for the attacker app. Consider for example 2FA codes. By default, these 6-digit codes are refreshed every 30 seconds [38]. This imposes a strict time limit on the at…

Since there's only 3 or so (google, microsoft authenticator, okta, anyone else?) apps in widespread use, that seems not actually like an obstacle?

I assume Authy is fairly high use. I use Aegis usually, but I likely it has very little usage share.

Re: Pixnapping Attack

#69

Post by hansvm »

tabbott wrote: post #61

In my view, the core issue here is that Android's permissions system doesn't consider "Running in the background" and "Accessing the Internet" to be things that apps need to ask the user for permission and the user can restrict. This attack wouldn't work if every app, even an "offline game", has those implicit permissions by default. Many apps should at most have "Only while using the app" permission to access the In…

> now-malicious app that you never use

Mildly off-topic, do you know of any good studies in the dangerous defect rate of auto-updating vs never/manually updating in a semi-sandboxed environment like Android?

Re: Pixnapping Attack

#70

Post by GuB-42 »

tabbott wrote: post #61

In my view, the core issue here is that Android's permissions system doesn't consider "Running in the background" and "Accessing the Internet" to be things that apps need to ask the user for permission and the user can restrict. This attack wouldn't work if every app, even an "offline game", has those implicit permissions by default. Many apps should at most have "Only while using the app" permission to access the In…

Here is a rather convincing answer about why not require user approval for internet access in Android applications. From the Android developers themselves.

https://old.reddit.com/r/androiddev/comments/ci4tdq/were_on_...

I don't know about "running in the background" but Android work using "intents", which mean an app can be woken up effectively at any time, so "don't allow app to run in the background" may not do what you expect.

Post reply on HN