An essential component of the mobile app market is Android’s Accessibility Service and the network of reputable accessibility service apps. However, in the absence of defence, accessibility services could continue to be a favourite target for mobile malware. In addition, accessibility services can be a potent component of fresh, complex types of mobile malware on Android smartphones. These days, mobile banking and other transaction-based mobile apps are the target of blended, extremely complex cyberattacks by cybercriminals using Android Accessibility Services.
Accessibility Service Malware
Over the past few years, malware designed specifically to exploit the Android Accessibility Service event framework have emerged to be a major threat to mobile banking and other transaction based mobile apps. Service malware may adapt and receive new targets and payloads remotely by using strong system callbacks and command and control features.
How Accessibility Service Malware Operates
- Listening and Modifying Accessibility Events
Using Android Accessibility Services is set at the device level. Once enabled, Accessibility Services is available for all applications on Android device and makes a powerful event framework available to external applications allowing such applications to receive information and perform inputs on behalf of users for key actions in a mobile app, such as knowing when users are on specific screens, tapping a button or entering text into a field.
- Input Capture Attack-Overlays and Keylogging
The Accessibility Service Malware can be made aware of the specific user interface that it is harvesting. This means that transaction, PII and other data from the compromised mobile app can be harvested by the Accessibility Services Malware using several types of input capture attacks.
- Injection Attacks: Auto-Tapping and Keystrokes
Injection attacks are a set of techniques that impersonates user interaction with mobile application, including keystrokes, form or field inputs, taps, and other movements, all without the user’s awareness.
- MFA/2FA Bypass-Used for Fake Transactions
The pinnacle of Android accessibility service malware is 2FA-bypassing malware. Although this sort of attack has various variations, the fundamental scenario is that the accessible virus gets the 2FA token via SMS of 2FA app, then passes the stolen token as a parameter during the transaction.
- Command and Control (C2C) for Targeting and ATS Payloads
Most Accessibility Service Malware uses a remote command and control (C2C) framework to receive updates ATS payloads including lists of apps to target and tailor-made malicious payloads for targeted applications.
Protect Mobile Apps from Accessibility Service Malware
Most security experts highly suggest that a multi-layered security approach is a stronger defence against any attack. Accessibility Service Malware is an ever evolving and constantly changing part of the malware ecosystem. In the DevOps Ci/CD pipeline, Quixxi’s 360 degree app security solution provides Android developers and cyber teams with a complete, automated method for building, testing, protecting and monitoring Accessibility Service Malware defence in Android mobile apps.
At Quixxi, we recommend deploying a multi-layered defence that offers mobile app security and management solution. To that extent, Quixxi offers 5 indispensable tools; SAST Scan, DAST Scan, API Scan, Shield, Supervise. First, Quixxi SAST (Static Application Security Testing) is a comprehensive and automated process that analyses your application to identify security vulnerabilities and potential risks. With Quixxi SAST scanning, you can be confident that your applications are secure and meet industry standards.
Quixxi DAST is a more comprehensive scanning solution that helps you identify and fix security vulnerabilities in your mobile apps. Quixxi API Scan simplifies the cumbersome process of scanning and identifying security vulnerabilities and weakness in the APIs. As we know Security is a concept that implies different choices and shades based on individual mobile apps, Quixxi Shield provides codeless application protection against hackers looking to clone, tamper, inject malicious code, or in general exploit your mobile app. A simple drag and drop of the executable files of your Android apps is all you need, to apply a sophisticated set of security layers, for quick and easy mobile app protection.
Finally, Quixxi Supervise (Intelligence Threat Defence) completes the shield self-defence algorithm with complete real-time threat intelligence. It provides real-time threat monitoring and reporting through the dashboard, encompassing live threat logs, flagged device users, and malware detection.
