There is a recent malware called MalLocker that hijacks and occupies the full screen size by using SYSTEM_ALERT_WINDOW
permission. It poses as ransomware by looking as such but doesn't encrypt files.
"The notification was intended to be used for system alerts or errors, but Android threats misused it to force the attacker-controlled UI to fully occupy the screen, blocking access to the device. Attackers create this scenario to persuade users to pay the ransom so they can gain back access to the device," - Microsoft
- Is there a way to forcefully withdraw any ongoing permissions used by Android apps (and preserving current state of the device)?
I think that the adb
command can be useful here, but it is likely that debugging mode needs to be enabled on the android device, which requires the device to be in developer mode.
To troubleshoot:
- How can debugging mode be enabled without expressly enabling it in the GUI?
- Would it be useful to connect the infected device to a terminal while being in debugging mode, or can't a android device infect a PC this way up?
- If
adb
can be used, and the permission in context is revoked then how will this affect the unwanted overlay screen? Will the app just break or will it stay since it used the permission already?
Note: my last question is very practical, for this reason I just want to now how this affects running apps in general.