Hackers can steal 2FA codes and personal messages from Android telephones

The brand new assault class is paying homage to GPU.zip, a 2023 assault that allowed malicious web sites to learn the usernames, passwords, and different delicate visible knowledge displayed by different web sites. It labored by exploiting facet channels present in GPUs from all main suppliers. The vulnerabilities that GPU.zip exploited have by no means been fastened. As an alternative, the assault was blocked in browsers by limiting their skill to open iframes, an HTML ingredient that enables one web site (within the case of GPU.zip, a malicious one) to embed the contents of a web site from a distinct area.

Pixnapping targets the identical facet channel as GPU.zip, particularly the exact period of time it takes for a given body to be rendered on the display screen.

“This permits a malicious app to steal delicate info displayed by different apps or arbitrary web sites, pixel-by-pixel,” Alan Linghao Wang, lead creator of the analysis paper “Pixnapping: Bringing Pixel Stealing out of the Stone Age,” defined in an interview. “Conceptually, it’s as if the malicious app was taking a screenshot of display screen contents it mustn’t have entry to. Our end-to-end assaults merely measure the rendering time per body of the graphical operations… to find out whether or not the pixel was white or non-white.”

Pixnapping in three steps

The assault happens in three principal steps. Within the first, the malicious app invokes Android APIs that make calls to the app the attacker desires to listen in on. These calls can be used to successfully scan an contaminated system for put in apps of curiosity. The calls can additional trigger the focused app to show particular knowledge it has entry to, corresponding to a message thread in a messaging app or a 2FA code for a selected web site. This name causes the data to be despatched to the Android rendering pipeline, the system that takes every app’s pixels to allow them to be rendered on the display screen. The Android-specific calls made embody actions, intents, and duties.