I'm looking at the security of both iOS and Android from a Touch-jacking security perspective. In other words, I expect that an application can be in a secure state to ensure that no overlays, screen capture, or other way of leaking screen data to an unauthorized app.

For example, I want to ensure that the PIN entry of Goodlink Secure Email is deployed on an OS that supports reasonable protection against such malware.

  • Does the architecture of iOS allow for such security?
  • Does the architecture of Android allow for such security?
  • Does the architecture of Windows Mobile (Windows 10) allow for such security?

Since I'm allowed only one accepted answer, if anyone adds information regarding the other operating systems, and the accepted answer misses this, I will return and award a sizable bounty for each answer.

Here is a StackOverflow answer for Android:

The tapjacking attack has been blocked at the OS level since Android 4.0. For such devices, you do not need to do anything to prevent tapjacking attacks.

android:filterTouchesWhenObscured="true" helps on API Levels 9-13. It did not exist prior to that, and so that attribute will be ignored on older devices, if you are supporting those.

This newer article (English translation provided at bottom of link) states that setting these parameters on a window:

– LayoutParams.FLAG_NOT_FOCUSABLE (the window can’t receive the focus)

– LayoutParams.FLAG_NOT_TOUCHABLE (touch events will never be transmitted to this window)

– LayoutParams.FLAG_NOT_TOUCH_MODAL (touch events will automatically be transmitted to the underlying activity)

will allow touchjacking. They claim they have tested this on Android 4.3 and 4.4. If this is correct (I've not tested it) then Android is susceptible to touchjacking. (If you test this, let me know in the comments what your results are and I'll add them to this answer.)

  • 1
    This article seems to say that touchjack attack is still possible. Scroll to end of French article for (partial) English translation. – Neil Smithline Aug 19 '15 at 1:22
  • Nice find! You should toss a summary of that article into your answer! – Mike Ounsworth Aug 19 '15 at 1:47
  • I'm on Safari and can't translate that page, so yes a summary would be nice. Also this describes more about the original android vulnerability blog.lookout.com/blog/2010/12/09/android-touch-event-hijacking – random65537 Aug 19 '15 at 1:53
  • I just noticed on iOS (10) that a system alert (in this case touch ID alert) is shifted up the screen if you are spamming clicks very quickly in the area that it is going to appear in. – Mike Weller Oct 20 '16 at 12:13

What do you define as unauthorized app? For example if your (Android)-users install a new keyboard, the author of this keyboard "could" read all information a user types with it. Android even warns about this, but not every user listens to warning labels...

All publicly disclosed touchjacking attacks depend on inserting a malicious layer into webviews, not on an unrelated piece of malware. Assuming you are only installing from a trusted source (i.e. signed code from Good) via a trusted platform (Google Play, Apple Store, Microsoft whatever) then touchjacking attacks are unlikely.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.