Communications of the ACM
Hacking Gmail With 92 Percent Success
Researchers at the University of California, Riverside have found a vulnerability in smartphone operating systems that could be used to obtain personal information.
Credit: UCR Newsroom
University of California, Riverside (UCR) researchers have uncovered a weakness believed to exist in Android, Windows, and iOS mobile operating systems that could be used to obtain personal information from unsuspecting users.
The attack works by getting a user to download a seemingly safe, but actually malicious, app such as one for background wallpaper on a phone. The attackers can then exploit a newly discovered public-side channel, which is the shared memory statistics of a process, and which can be accessed without any privileges. The researchers track changes in shared memory and are able to correlate changes to what they call an activity transition event. Enhanced with a few other side channels, the researchers found it is possible to fairly accurately monitor in real time which activity a victim app is in. The attack must take place at the exact moment the user is logging into the app or taking a picture, and also needs to be carried out in an inconspicuous way.
"By design, Android allows apps to be preempted or hijacked," says UCR professor Zhiyun Qian. "But the thing is you have to do it at the right time so the user doesn't notice. We do that and that's what makes our attack unique."
From UCR Newsroom
View Full Article
Abstracts Copyright © 2014 Information Inc., Bethesda, Maryland, USA
No entries found