Researcher Details Tap Jacking Attacks and Bypasses on Android Security Protections

The presentation by Rumchan, a researcher focused on AOSP bug hunting and mobile security, details 'tap jacking' attacks on Android, where malware overlays windows to trick users into granting permissions or transferring money. Before Android 10, attackers exploited the SYSTEM_ALERT_WINDOW permission to create clickable overlays, while a CVE post-Android 10 allowed permissionless overlays via activities. Google mitigated these threats with protections like the FLAG_WINDOW_IS_OBSCURED and 'trust overlay' checks, which block untrusted overlays, and 'input sync' layers that prevent touch events from passing through untrusted windows. Rumchan demonstrated bypasses for these protections, including exploiting IPC (Inter-Process Communication) flaws in Android’s binder mechanism, manipulating Picture-in-Picture (PiP) windows, and abusing animation transactions to hide permission dialogs. One bug, present for at least five years (fixed in 2026), allowed attackers to make target windows invisible but still touchable. The talk culminated in a proof-of-concept exploit chain that gained ADB permissions without requiring any app permissions on modern Android devices.