2

I have seen that android does not allow installation of any apk when screen filters are enabled.Do they cause any security risks?

  • Somewhat off-topic, but look for "Night Mode" in future Android versions. It was briefly in Nougat (and still is in some Nougat-based custom ROMs) so I assume it'll make a reappearance if it hasn't already without me knowing. – Ben Aug 7 '17 at 15:14
3

The problem is with the DRAW OVER APPS permission. Android will not let you change any system level changes or install anything while an app is overlaying your screen. The reasoning being since the app can hide a malicious request and have the button pressed under it. Be very wary of any app that requests this permission and make sure you truly trust the developer. Check out this link for more details on tapjacking. XDA Developers - Tapjacking

  • +1 Great answer. Can you expand your description of the attack, and exactly what the attack is and is not capable of? – Mike Ounsworth Aug 7 '17 at 18:54
  • It is called tapjacking. Please see this link: xda-developers.com/… – user218076 Aug 7 '17 at 19:20
1

TL;DR-

If it's a "3rd party applications" it could be/More likely than a 1st party or 2nd party apps.

--------------------

What's 3rd party apps are:

Third party apps are those provided by a, hrm, third party. Though the following terms are non-existent, you can visualize this as follows: First party is the one providing the OS (AOSP/Google), second party the manufacturer (adding his own apps).

Basically, this can be read as: Everything that didn't come pre-installed. This is what the term "third party" normally is used for

Reference: https://android.stackexchange.com/questions/92248/whats-really-third-party-applications

Now, I recommend to always look at the app's permissions request before actually downloading them.

Let's have a look at the "Bluelight Filter for Eye Care" app's permissions in the "PlayStore":

  1. Draw over other apps - Could hide some malicious button hidden.
  2. Have full network access - Could be harmfull by sending information from your phone.
  3. Run at startup - Suspicious in some way (reminds me of some rat/keyloggers apps).
  4. Prevent phone from sleeping - Ok.
  5. Install shortcuts - Ok.
  6. Retrieve running apps -Ok.
  7. Receive data from internet - I guess that's for updates/Ads but could be harmful.
  8. View network connections - Ok.
  9. Expand/collapse status bar - Ok.
  10. View Wi-Fi connections -Ok.

Conclusion:

Anything in our world is/should be suspicious, even "Facebook" app (There are rumors that they send information to the NSA), but I still you use it. all I'm trying to say is that you should be careful and check for the permission it requests and if you see something suspicious think again if you really need that and willing to risk your personal information for that.

  • Good answer, but can you directly address the title question of whether screen filter apps can view the contents they are drawing over? – Mike Ounsworth Aug 7 '17 at 18:56
1

Yes, they absolutely create security risks. For them to work, you must grant them permission to draw over other screens on your phone, while passing touch events to the underlying screen.

A benevolent, well-behaved app draws a mostly transparent red overlay on top of all other screens.

A malicious app could very well display its own screens completely opaque while secretly passing your touches along to an underlying app. That means you might be doing just about anything, including granting the app more permissions or allowing it to install other apps without having any idea.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.