Keep Your Android Phone Safe From Pixnapping - DTNS 5124  ## Metadata - Author: [[Daily Tech News Show]] - Full Title: Keep Your Android Phone Safe From Pixnapping - DTNS 5124 - Category: #podcasts - URL: https://share.snipd.com/episode/06991a87-873e-4d28-b006-45e06c0a960c ## Document Notes ## Highlights - **How PickSnapping Steals On-Screen Data** - PickSnapping exploits Android rendering to infer on-screen pixels without special permissions. - Researchers used GPU timing side-channels to reconstruct MFA codes by overlaying transparent frames. Transcript: Tom Merritt Scientists from the University of California, Berkeley, University of Washington, UC San Diego, and Carnegie Mellon University presented a paper this week at the 32nd ACM Conference On Computer and Communication Security. So this is a, you know, submitted paper in a peer-reviewed situation. The paper is called Pick Snapping, Bringing Pixel Stealing Out of the Stone Age. So not pick snapping, but picks napping, like kidnapping, but for your pixels, and you'll understand why in a minute. The team's exploit, and by the way, this is them discovering the exploit and then telling people about it so that it can be shut down, not something that's in the wild. It requires you to install a malicious app. So that's your first line of defense. Don't install a malicious app. That sounds easy. But of course, if people didn't get tricked into installing malicious apps all the time, this wouldn't be much of a concern. But if you have the hubris to think, I will never be tricked into installing a malicious app, then you don't need to worry. Once that malicious app gets installed, however they trick you into installing it, it takes advantage of the pick snapping exploit to read any data displayed on the screen without Needing special system permissions. So Jen, that's the basis of this is they're not hacking into the security of Android. They're seeing what's on your screen and saying, oh, well, if there's a multi-factor code up there, now we got it. It does this by invoking Android programming interfaces that can cause the targeted app to send said sensitive information to Android's rendering pipeline to be displayed on the Screen. So the malicious app can make the app send something. You don't have to wait for the user to do it. The app will then run graphical operations on the pixels on the screen. And the way it was described in the Ars Technica piece, for example, they might draw a transparent piece of content over the other content. So your malicious app draws the transparent content that causes the GPU to treat the pixels from the targeted app, like the multi-factor authentication app, differently. Then the malicious app can exploit a side channel attack in the GPU. The one they use in their research is GPU.zip. That's a known side channel vulnerability that has been mitigated, but in this case, it still exists, so they're able to use it. They say they could use others, though, if GPU.zip were to get shut down. And to oversimplify what they're doing, basically by drawing that transparent frame over the multi-factor code, it takes more time for a frame to be rendered on the screen behind that Transparent image. And that extra time can be detected to determine whether a pixel is white or not. So there's like C or not C, colored or not colored. And the app can use that information to map pixels to letters, numbers, shapes, and then deduce, oh, that's the code 326755. Now I have your multi-factor code. This attack takes time. So it doesn't always work in the 30 seconds you need while that code is on the screen for the multi-factor authentication app. If you're going after a different kind of information that isn't time sensitive, it's not a problem. But they were able to refine how this works and able to capture multi-factor codes on pixel devices. ([Time 0:02:46](https://share.snipd.com/snip/f682e438-72b1-4439-abef-cb9f223d08bc)) - **Don't Install Unknown Apps And Update Android** - Do not install untrusted apps; the exploit requires a malicious app on your device. - Keep Android security updates installed so Google's mitigations can protect you. Transcript: Tom Merritt It requires you to install a malicious app. So that's your first line of defense. Don't install a malicious app. That sounds easy. But of course, if people didn't get tricked into installing malicious apps all the time, this wouldn't be much of a concern. But if you have the hubris to think, I will never be tricked into installing a malicious app, then you don't need to worry. Once that malicious app gets installed, however they trick you into installing it, it takes advantage of the pick snapping exploit to read any data displayed on the screen without Needing special system permissions. So Jen, that's the basis of this is they're not hacking into the security of Android. They're seeing what's on your screen and saying, oh, well, if there's a multi-factor code up there, now we got it. It does this by invoking Android programming interfaces that can cause the targeted app to send said sensitive information to Android's rendering pipeline to be displayed on the Screen. So the malicious app can make the app send something. You don't have to wait for the user to do it. The app will then run graphical operations on the pixels on the screen. And the way it was described in the Ars Technica piece, for example, they might draw a transparent piece of content over the other content. So your malicious app draws the transparent content that causes the GPU to treat the pixels from the targeted app, like the multi-factor authentication app, differently. Then the malicious app can exploit a side channel attack in the GPU. The one they use in their research is GPU.zip. That's a known side channel vulnerability that has been mitigated, but in this case, it still exists, so they're able to use it. They say they could use others, though, if GPU.zip were to get shut down. And to oversimplify what they're doing, basically by drawing that transparent frame over the multi-factor code, it takes more time for a frame to be rendered on the screen behind that Transparent image. And that extra time can be detected to determine whether a pixel is white or not. So there's like C or not C, colored or not colored. And the app can use that information to map pixels to letters, numbers, shapes, and then deduce, oh, that's the code 326755. Now I have your multi-factor code. This attack takes time. So it doesn't always work in the 30 seconds you need while that code is on the screen for the multi-factor authentication app. If you're going after a different kind of information that isn't time sensitive, it's not a problem. But they were able to refine how this works and able to capture multi-factor codes on pixel devices. They couldn't do it on the Galaxy S25. Might be, I did not read this, because of the way Samsung provides their own interpretation of screen with one UI and all that. If you have obfuscated information, hidden information, say a pass key or something where nothing is displayed on the screen, this vulnerability can't access that. It's only stuff that can be displayed on a screen. It works on the Google Pixel. It works on the Samsung Galaxy S25. Google has released partial mitigations as of the September Android Security Bulletin. A modified version of the exploit, however, can still work. And Google says further mitigations are coming in the December Android Security Bulletin. No in the wild exploits have been discovered yet. Jenn Cutter I was very happy to read that last no in the wild stuff because I'm thinking, OK, how do I explain this to my parents? My parents switched back to Android. They got just such a good deal. They didn't want to spend the money on the new apples. Because like malicious apps, again, like every listener knows the deal there. We don't have to come back to that. But to my parents, my dad's phone is bare bones. My dad has what came with the phone. And that's what the phone is for. It's for being a phone. My mom loves every little coloring book and puzzle app under the sun. No matter who made it, I don't think she's ever looked at who made it. And I always wonder, like, how much stuff is sneaking through on the quote unquote women apps? Tom Merritt Yeah. And the Google Play Store does try to stop malicious apps from coming in. So, you know, there is protection that your mom doesn't have to take advantage of. That'll happen. So chances are she won't download the wrong one. But stuff can sneak through. And the mitigations coming in December are really your best hope for that is to say, like, make sure to be patched. Make sure to be updated. Get that security update so that you're not worried about this. Jenn Cutter Yeah, because like there, I'm pretty sure they got like the galaxies, which helps like not a lot of two factor for, say, my parents specifically. And I like the big thing for them would have been passwords. Since passwords generally show up as uh the little dots they uh they are mostly okay with that because that would be considered you know obfuscated because nothing is on there unless They hit the little i button to see the password and then this sounds like something that this could have grabbed it has to target the area of the screen it thinks the information is going Tom Merritt To be on. It's not doing screen capture. That's an important side note here. Smaller bits. Yeah. So in this case, SMS could conceivably be more secure. It's less secure overall, but in this specific case, because the app doesn't know when you're going to get an SMS, right? And so it can't force you to get a second factor code sent to it. And the way the app usually works is it initiates the launch of the app. So it's really going after, do you have Authy or Google Authenticator or something like that? Jenn Cutter Like it said in the explainer, where you know where that bit's going to show up much easier to target. Tom Merritt Yeah, exactly. So this, again, they are going to release the source code at a responsible time. There is no in the wild exploit, but the source code is not out there yet. And Google is working on the mitigations for this. ([Time 0:03:26](https://share.snipd.com/snip/6348606b-5e1e-4981-a2e0-32f5cc46aae5)) - **Timing Makes The Attack Unreliable For Short Codes** - The attack is slow and not guaranteed to capture short-lived codes like 30-second MFA tokens. - It works better for static or long-lived on-screen data, reducing immediate risk for some MFA flows. Transcript: Tom Merritt Now I have your multi-factor code. This attack takes time. So it doesn't always work in the 30 seconds you need while that code is on the screen for the multi-factor authentication app. If you're going after a different kind of information that isn't time sensitive, it's not a problem. But they were able to refine how this works and able to capture multi-factor codes on pixel devices. They couldn't do it on the Galaxy S25. Might be, I did not read this, because of the way Samsung provides their own interpretation of screen with one UI and all that. If you have obfuscated information, hidden information, say a pass key or something where nothing is displayed on the screen, this vulnerability can't access that. It's only stuff that can be displayed on a screen. It works on the Google Pixel. It works on the Samsung Galaxy S25. Google has released partial mitigations as of the September Android Security Bulletin. A modified version of the exploit, however, can still work. And Google says further mitigations are coming in the December Android Security Bulletin. No in the wild exploits have been discovered yet. Jenn Cutter I was very happy to read that last no in the wild stuff because I'm thinking, OK, how do I explain this to my parents? My parents switched back to Android. They got just such a good deal. They didn't want to spend the money on the new apples. Because like malicious apps, again, like every listener knows the deal there. We don't have to come back to that. But to my parents, my dad's phone is bare bones. My dad has what came with the phone. And that's what the phone is for. It's for being a phone. My mom loves every little coloring book and puzzle app under the sun. No matter who made it, I don't think she's ever looked at who made it. And I always wonder, like, how much stuff is sneaking through on the quote unquote women apps? Tom Merritt Yeah. And the Google Play Store does try to stop malicious apps from coming in. So, you know, there is protection that your mom doesn't have to take advantage of. That'll happen. So chances are she won't download the wrong one. But stuff can sneak through. And the mitigations coming in December are really your best hope for that is to say, like, make sure to be patched. Make sure to be updated. Get that security update so that you're not worried about this. Jenn Cutter Yeah, because like there, I'm pretty sure they got like the galaxies, which helps like not a lot of two factor for, say, my parents specifically. And I like the big thing for them would have been passwords. Since passwords generally show up as uh the little dots they uh they are mostly okay with that because that would be considered you know obfuscated because nothing is on there unless They hit the little i button to see the password and then this sounds like something that this could have grabbed it has to target the area of the screen it thinks the information is going Tom Merritt To be on. It's not doing screen capture. That's an important side note here. Smaller bits. Yeah. So in this case, SMS could conceivably be more secure. It's less secure overall, but in this specific case, because the app doesn't know when you're going to get an SMS, right? And so it can't force you to get a second factor code sent to it. And the way the app usually works is it initiates the launch of the app. So it's really going after, do you have Authy or Google Authenticator or something like that? Jenn Cutter Like it said in the explainer, where you know where that bit's going to show up much easier to target. Tom Merritt Yeah, exactly. So this, again, they are going to release the source code at a responsible time. There is no in the wild exploit, but the source code is not out there yet. And Google is working on the mitigations for this. It doesn't always work all the time. It takes some effort. ([Time 0:05:55](https://share.snipd.com/snip/50622938-ac40-46c8-85a3-20ce6f328244)) - **Vendor Rendering Differences Affect Risk** - The vulnerability depends on how a vendor implements rendering; Samsung's One UI differences affected outcomes. - Vendor-specific behavior means some Android devices are less susceptible to the same exploit. Transcript: Tom Merritt It works on the Samsung Galaxy S25. Google has released partial mitigations as of the September Android Security Bulletin. A modified version of the exploit, however, can still work. And Google says further mitigations are coming in the December Android Security Bulletin. ([Time 0:06:46](https://share.snipd.com/snip/deedd62d-3b94-4beb-803d-c00a968f10d0)) - **Parents Installing Casual Apps Raises Risk** - Jenn Cutter described her parents switching back to Android and concerns about downloading many casual apps. - She worries her mom will install puzzle apps without checking makers, increasing malware risk. Transcript: Jenn Cutter My parents switched back to Android. They got just such a good deal. They didn't want to spend the money on the new apples. Because like malicious apps, again, like every listener knows the deal there. We don't have to come back to that. But to my parents, my dad's phone is bare bones. My dad has what came with the phone. And that's what the phone is for. It's for being a phone. My mom loves every little coloring book and puzzle app under the sun. No matter who made it, I don't think she's ever looked at who made it. And I always wonder, like, how much stuff is sneaking through on the quote unquote women apps? Tom Merritt Yeah. And the Google Play Store does try to stop malicious apps from coming in. So, you know, there is protection that your mom doesn't have to take advantage of. That'll happen. So chances are she won't download the wrong one. But stuff can sneak through. And the mitigations coming in December are really your best hope for that is to say, like, make sure to be patched. Make sure to be updated. Get that security update so that you're not worried about this. Jenn Cutter Yeah, because like there, I'm pretty sure they got like the galaxies, which helps like not a lot of two factor for, say, my parents specifically. ([Time 0:07:13](https://share.snipd.com/snip/ab6376ac-212e-4209-97de-2d8e599cd914)) - **Hide Passwords And Favor Unpredictable MFA** - Avoid showing plaintext passwords on-screen and rely on obfuscation features (dots) whenever possible. - Prefer MFA methods that are unpredictable in timing, like SMS or push, when threat model warrants it. Transcript: Tom Merritt Has to target the area of the screen it thinks the information is going to be on. It's not doing screen capture. That's an important side note here. Smaller bits. Yeah. So in this case, SMS could conceivably be more secure. It's less secure overall, but in this specific case, because the app doesn't know when you're going to get an SMS, right? And so it can't force you to get a second factor code sent to it. And the way the app usually works is it initiates the launch of the app. So it's really going after, do you have Authy or Google Authenticator or something like that? Jenn Cutter Like it said in the explainer, where you know where that bit's going to show up much easier to target. Tom Merritt Yeah, exactly. So this, again, they are going to release the source code at a responsible time. There is no in the wild exploit, but the source code is not out there yet. ([Time 0:08:44](https://share.snipd.com/snip/7cbc0a1e-f7e8-42a9-b232-e143ff39ab82)) - **Limit Token Apps And Overlay Permissions** - Monitor installed apps and remove anything suspicious or unnecessary, especially token apps like Authy. - Limit app permissions and avoid granting overlay or drawing privileges to untrusted apps. Transcript: Tom Merritt Yeah, exactly. So this, again, they are going to release the source code at a responsible time. There is no in the wild exploit, but the source code is not out there yet. And Google is working on the mitigations for this. It doesn't always work all the time. It takes some effort. The chances that your average person is going to fall victim to this anytime soon are low. ([Time 0:09:29](https://share.snipd.com/snip/a711fbd7-1e28-4fda-be12-0bd5e4969c6a))