GUI-Squatting Attack: Automated Generation of Android Phishing Apps

Robustness of on-Device Models: Adversarial Attack to Deep Learning Models on Android Apps

“…unlike the central guardians of the cloud server, on-device models may be more vulnerable inside users' phones. For example, most model files can be obtained by decompiling Android apps without any obfuscation or encryption [18], [49]. Such model files may be exposed to malicious attacks.…”

On the Insecurity of SMS One-Time Password Messages against Local Attackers in Modern Mobile Devices

“…In this section, we elaborate on the attack in which an adversary can deceive users and obtain the SMS OTP message through a malicious installed app without any SMS-related permissions. Different from the previous phishing attacks in which the malicious app mimics the authentic UI and steal user inputs [14], [20], here, we focus on understanding how the newly introduced user-interactionbased mechanisms (e.g., the One-Tap mechanism) can affect the efficacy of UI deception attacks. Specifically, we first elaborate on the attack scenario and its root cause.…”

“…Following this line of research, in earlier years, research highlighted various attack channels. This includes physical access to the device [46], mobile malware which steals the SMS OTP message by requesting the less-restricted SMS permissions [12], as well as phishing attacks [9], [13], [14] that can get the SMS OTP code from the user input. Different from prior research, we systematically studied the practical ways an adversary can use to obtain the SMS OTP message through a malicious app running on a victim's device, dealing with the various new features introduced in modern mobile operating systems.…”

Phishing Attacks Survey: Types, Vectors, and Technical Approaches

“…From this analysis, a GUI is generated by combining code snippets for each element, trying to mimic the real app as closely as possible. Deception code is then introduced, which siphons the user's personal details to a remote server and generates a pop-up to mislead the user into believing that the issue is a technical issue with the app rather than a security threat [71]. This method has been proved to bypass many modern anti-phishing techniques including layout similarity, visual similarity, personalized indicators, and window integrity methods.…”