Yesterday, Ars Technica posted an article explaining that Android was found to be vulnerable to a UI interference attack.
This claim originates from a paper published by Alfred Chen et al. of the University of Michigan a few days ago, which states that other operating systems are likely vulnerable to this same attack.
In fact, this design is not specific to Android: nearly all popular OSes such as Mac OS X, iOS, and Windows also adopt this shared-memory mechanism for their window managers. Thus, we believe that our attack on Android is likely to be generalizable to other platforms.
Chen et al. show that these attacks can be used to steal login information or other sensitive information from unsuspecting users with relatively high success rates.
In our evaluation, we show that for 6 out of 7 popular Android apps, the UI state interference accuracies are 80-90% for the first candidate UI states, and over 93% for the top 3 candidates.
This sounds like it could pose an immediate and serious risk to the privacy of smartphone and PC users. What can be done to minimize vulnerability and protect oneself against a UI state interference attack?