Malicious app required to make “Pixnapping” attack work requires no permissions.

The new attack, named Pixnapping by the team of academic researchers who devised it, requires a victim to first install a malicious app on an Android phone or tablet. The app, which requires no system permissions, can then effectively read data that any other installed app displays on the screen. Pixnapping has been demonstrated on Google Pixel phones and the Samsung Galaxy S25 phone and likely could be modified to work on other models with additional work. Google released mitigations last month, but the researchers said a modified version of the attack works even when the update is installed.

  • 0_o7@lemmy.dbzer0.comEnglish
    372·
    1 day ago

    requires a victim to first install a malicious app on an Android phone or tablet.

    Okay, that’s not so bad

    The app, which requires no system permissions, can then effectively read data that any other installed app displays on the screen.

    but the researchers said a modified version of the attack works even when the update is installed.

    Holy fuck, how the fuck does this even happen? No permission but still read screen data? That’s a horrible flaw. Does google intentionally do this so they can read all user activity ever? And even their fixes are flawed? Fuck

    • Possibly linux@lemmy.zipEnglish
      2·
      11 hours ago

      This headline is a bit click baity

      It is bad but because it is a side channel attack it very hard to pull off. You need the starts to align and for the user to stay on the same screen for a long time for it to actually be exploited.

      • ReversalHatchery@beehaw.orgEnglish
        1·
        12 hours ago

        screen capture is an entirely different thing though, and that was not available without permissions for a very long time

        • f4f4f4f4f4f4f4f4@sopuli.xyzEnglish
          1·
          10 hours ago

          This is true. Non-Google apps trying to read your screen had to convince users to enable Accessibility permission.

    • fluxion@lemmy.worldEnglish
      11·
      19 hours ago

      Google has actually done quite a bit of work to guard against this sort of thing in a general sense:

      https://source.android.com/docs/core/virtualization/architecture

      It effectively isolates every page of data for an application from other applications and even from the OS itself by using hardware virtualization support on ARM

      But things like video frame buffers are shared resources that can’t be easily isolated on this way and that seems to be the attack vector in this case. That not to say this isn’t a failure on Google’s part to not catch this, but they aren’t the bad guys in this case and seem to be trying to address it

    • CallMeAnAI@lemmy.worldEnglish
      101·
      22 hours ago

      Bugs happen. You act like there has never been a serious FoSS vulnerability.

      They are working with the researchers and addressing it 🤷‍♂️.

    • Tollana1234567@lemmy.todayEnglish
      148·
      1 day ago

      google wants all your data, so it make sense theres this vulnerability, remember the android core spy app they tried to secretely install to peoples phones.

      • MaggiWuerze@feddit.orgEnglish
        15·
        23 hours ago

        Googles Apps run with what are basically root permissions. They don’t need to design the permissions in such a way to get access, they can just do what they want

        • BCsven@lemmy.caEnglish
          4·
          17 hours ago

          That’s why I put GrapheneOS on my phone. It sandboxes apps and you can grant specific containerized storage spaces aaccesa per app.

          But screen reading OOF, I thought that would have needed screen overlay permissions.

          • ReversalHatchery@beehaw.orgEnglish
            1·
            12 hours ago

            I don’t think the screen overlay permission gives access for screen capture

            I was wrong. but this article seems to imply that it’s screen overlay permission is what is needed for this to work.

          • MaggiWuerze@feddit.orgEnglish
            2·
            15 hours ago

            If only they would support more devices. Maybe they will broaden their lineup now that Google has basically curb stomped them

  • ikt@aussie.zoneEnglish
    12·
    1 day ago

    …

    requires a victim to first install a malicious app

    these new “hacks” suck, bring back worms that would shut your pc down just after you connected to the net, that was hacking! 👨‍🦳

    • MoonMelon@lemmy.mlEnglish
      3·
      18 hours ago

      I worked at a computer store when blaster happened. Shit was wild, for weeks. People blamed us too, of course. We started giving away patch disks for free.

      • Gravitywell.xYz@sh.itjust.worksEnglish
        5·
        1 day ago

        Except you have to grant permission to install it, thats a pretty big one, especially for average users who dont have Sideloading enabled

        • bountygiver [any]@lemmy.mlEnglish
          4·
          1 day ago

          I doubt Google actually reviews each app submitted line by line of code. So a malicious developer can theoretically sneak it in one popular app via play store updates.

          Good thing the point of 2FA is the 2 factor part so this only compromises one of the two, without some very coordinated attack it’s still quite hard to gain access to your accounts.

          • BCsven@lemmy.caEnglish
            1·
            17 hours ago

            Hardware key is the way. Like a Yubikey

            Code is generated on another device by using the encryption stored on the hardware key.

            Since this app can read screen, you need a non network connected device to act as the key displayer.