Most Android users are vulnerable to a newly disclosed type of attack that could give hackers full control over a device, according to researchers.
The ‘high-severity’ flaw has been fixed in Google’s September release of Android patches, and it doesn’t affect the latest operating system release, Android 8.0 Oreo, according to Palo Alto Networks.
But it affects all versions prior to 8.0, meaning nearly all Android users are vulnerable.
“Since Android 8.0 is a relatively recent release, this means that nearly all Android users should take action today and apply updates that are available to address this vulnerability,” the company said in an advisory.
Once a program is granted full privileges it can install software such as ransomware or programs that aim to steal data, Palo Alto said.
“This vulnerability could be used to take control of devices, lock devices and steal information after it is attacked,” the company said.
Previously it was thought overlay attacks could only work if they were installed from Google’s Play Store and explicitly requested the ‘draw on top’ permission when installed, Palo Alto said.
But its research found the same type of attack can be carried out using a pop-up window feature called ‘Toast’. The Toast overlay attack doesn’t require the user to grant a specific permission, and works on applications installed from third-party app stores.
“Our researchers have outlined how it’s possible to create a Toast window that overlays the entire screen, so it’s possible to use Toast to create the functional equivalent of regular app windows,” Palo Alto wrote.
The firm advised users to obtain the patch from their device vendor or update to Android 8.0.
Google’s official Play Store is considered more secure than third-party application outlets, but apps infected with malicious code are regularly found there, too.
What do you know about the history of mobile messaging? Find out with our quiz!
Thoma Bravo agrees to acquire Darktrace for $5.32 billion in cash, delivering some welcome news…
Customer adoption of AI services embedded in cloud services continues to deliver results for Microsoft,…
TikTok's 'secret source' algorithm is so core to ByteDance, it would rather shut down US…
After relocating from California to Texas in 2020, Oracle's Larry Ellison now reveals plan to…
Share price hit after Meta admits heavy AI spending plans, after posting strong first quarter…
For third time Google delays phase-out of third-party Chrome cookies after pushback from industry and…