A Study on the Vulnerability of Security Keypads in Android Mobile Using Accessibility Features

Lee, Jung-Woong; Kim, In-Seok

doi:10.13089/jkiisc.2016.26.1.177

Cited by 2 publications

(3 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Prior to the availability of the Android autofill service, many password managers used the Android accessibility (a11y) service to hack in support for autofill. We chose not to include the a11y service in our evaluation for two reasons: first, it is not and designed as an autofill framework and thus does not serve as a meaningful point of comparison and second, it is now well-known that the accessibility service is ill-suited to be used for security purposes [12], [13], [11], [17].…”

Section: Evaluation Methodologymentioning

confidence: 99%

“…One drawback of this approach is it does require the users to give accessibility permissions to the password manager, which is not a straightforward process. Additionally, research has shown that relying on the accessibility service introduces numerous security vulnerabilities [11], [12], [13], [17].…”

Section: B Autofill On Androidmentioning

confidence: 99%

“…However, because OpenYOLO requires more effort to implement than and was not designed to be interoperable with the autofill service, it has not seen wide adoption. 13 .…”

Section: B Autofill On Androidmentioning

confidence: 99%

See 2 more Smart Citations

The Emperor's New Autofill Framework: A Security Analysis of Autofill on iOS and Android

Oesch,

Gautam,

Ruoti

2021

Preprint

View full text Add to dashboard Cite

Password managers help users more effectively manage their passwords, encouraging them to adopt stronger passwords across their many accounts. In contrast to desktop systems where password managers receive no system-level support, mobile operating systems provide autofill frameworks that are designed to integrate with password managers to provide secure and usable autofill for browsers and other apps installed on mobile devices. In this paper, we conduct the first holistic security evaluation of such frameworks on iOS and Android, examining whether they achieve substantive benefits over the ad-hoc desktop environment or become a problematic single point of failure. Our results find that while the frameworks address several common issues (e.g., requiring user interaction before autofill), they also enforce insecure behavior and fail to provide the password managers implemented using the frameworks with sufficient information to override this incorrect behavior. Within mobile browsers, this results in managers being less secure than their desktop counterparts. Within apps, incorrect handling of WebView controls leads to manager-assisted phishing attacks from malicious apps or domains, depending on how autofill is implemented. Based on our results, significant improvements are needed for mobile autofill frameworks and we conclude the paper with concrete recommendations for the design and implementation of more secure autofill frameworks.

show abstract

Section: Evaluation Methodologymentioning

confidence: 99%