ユーザーは、スマートフォンの画面に映っているアプリが、現在操作しているアプリだと当然考えるだろう。だが、その常識を打ち破る新たな攻撃手法が明らかになった。操作しているアプリとは異なるアプリの画面を表示させるというのだ。これにより、攻撃者が意図した危険な操作をするようにユーザーを誘導できる。例えば、本来はセキュリティー上無効にしている設定を有効にさせることが可能だ。具体的にはカメラやマイク、位置

Google bile bu yeni saldırıya hazırlıksız yakalandı! TapTrap, dokunmatik etkileşimlerinizi görünmez bir ekrana yönlendiriyor. Acil önlemler şart!

A novel tapjacking technique can exploit user interface animations to bypass Android's permission system and allow access to sensitive data or trick users into performing destructive actions, such as wiping the device.

YouTube video by Get4Games Gaming

A new attack called TapTrap exploits Android's activity transition animations to trick users into granting sensitive permissions without their knowledge. Unlike traditional overlay attacks, TapTrap uses transparent activities during app transitions, making it virtually undetectable and effective even on Android 15. Researchers at TU Wien discovered the vulnerability after analyzing how Android handles app-to-app transitions. The attack works by launching a legitimate app with near-transparent animations, allowing malicious apps to position invisible buttons exactly where users expect to interact with their own interface.

Forscher der TU Wien präsentieren "TapTrap"-Attacke bei Konferenz in den USA. Gefährdet sind unter anderem Bank-Apps

After our Android 16 port was completed yesterday, we started fixing an Android tapjacking vulnerability disclosed last month: https://t.co/iqkb3IQVVm We have a fix implemented and it will be included in our next release, likely with the monthly Android 16 update tomorrow.

同人誌の表紙やサークルロゴなどデザインをお手伝い！

A novel tapjacking technique can exploit user interface animations to bypass Android's permission system and allow access to sensitive data or trick users into performing destructive actions, such as wiping the device.