The new attack, named Pixnapping by the team of academic researchers who devised it, requires a victim to first install a malicious app on an Android phone or tablet. The app, which requires no system permissions, can then effectively read data that any other installed app displays on the screen. Pixnapping has been demonstrated on Google Pixel phones and the Samsung Galaxy S25 phone and likely could be modified to work on other models with additional work. Google released mitigations last month, but the researchers said a modified version of the attack works even when the update is installed.
requires a victim to first install a malicious app on an Android phone or tablet.
Okay, that’s not so bad
The app, which requires no system permissions, can then effectively read data that any other installed app displays on the screen.
but the researchers said a modified version of the attack works even when the update is installed.
Holy fuck, how the fuck does this even happen? No permission but still read screen data? That’s a horrible flaw. Does google intentionally do this so they can read all user activity ever? And even their fixes are flawed? Fuck
google wants all your data, so it make sense theres this vulnerability, remember the android core spy app they tried to secretely install to peoples phones.
Googles Apps run with what are basically root permissions. They don’t need to design the permissions in such a way to get access, they can just do what they want
That’s why I put GrapheneOS on my phone. It sandboxes apps and you can grant specific containerized storage spaces aaccesa per app.
But screen reading OOF, I thought that would have needed screen overlay permissions.
If only they would support more devices. Maybe they will broaden their lineup now that Google has basically curb stomped them
I don’t think the screen overlay permission gives access for screen captureI was wrong. but this article seems to imply that it’s screen overlay permission is what is needed for this to work.
“tried” why, do you think they failed?
https://f-droid.org/packages/io.nandandesai.privacybreacher
It hasn’t been updated in five years. I’m not sure of the current state of things in Android, but apps used to be able to access all kinds of personal data with zero permissions: listing all installed apps, access to sensors/accelerometers, battery level, when charger/headphones were last plugged or unplugged.
screen capture is an entirely different thing though, and that was not available without permissions for a very long time
This is true. Non-Google apps trying to read your screen had to convince users to enable Accessibility permission.
Its not actually capturing the screen though. Its display a transparent overylay on another app and using a timing side channel attack to track the pixels for the generated 2 factor auth code.
This headline is a bit click baity
It is bad but because it is a side channel attack it very hard to pull off. You need the starts to align and for the user to stay on the same screen for a long time for it to actually be exploited.
…
requires a victim to first install a malicious app
these new “hacks” suck, bring back worms that would shut your pc down just after you connected to the net, that was hacking! 👨🦳
I worked at a computer store when blaster happened. Shit was wild, for weeks. People blamed us too, of course. We started giving away patch disks for free.
