Android gadgets are susceptible to a brand new assault that may covertly steal two-factor authentication codes, location timelines, and different personal knowledge in lower than 30 seconds.
The brand new assault, named Pixnapping by the crew of educational researchers who devised it, requires a sufferer to first set up a malicious app on an Android cellphone or pill. The app, which requires no system permissions, can then successfully learn knowledge that some other put in app shows on the display screen. Pixnapping has been demonstrated on Google Pixel telephones and the Samsung Galaxy S25 cellphone and certain might be modified to work on different fashions with extra work. Google launched mitigations final month, however the researchers mentioned a modified model of the assault works even when the replace is put in.
Like Taking a Screenshot
Pixnapping assaults start with the malicious app invoking Android programming interfaces that trigger the authenticator or different focused apps to ship delicate data to the system display screen. The malicious app then runs graphical operations on particular person pixels of curiosity to the attacker. Pixnapping then exploits a facet channel that permits the malicious app to map the pixels at these coordinates to letters, numbers, or shapes.
“Something that’s seen when the goal app is opened may be stolen by the malicious app utilizing Pixnapping,” the researchers wrote on an informational web site. “Chat messages, 2FA codes, e mail messages, and many others. are all susceptible since they’re seen. If an app has secret data that’s not seen (e.g., it has a secret key that’s saved however by no means proven on the display screen), that data can’t be stolen by Pixnapping.”
The brand new assault class is paying homage to GPU.zip, a 2023 assault that allowed malicious web sites to learn the usernames, passwords, and different delicate visible knowledge displayed by different web sites. It labored by exploiting facet channels present in GPUs from all main suppliers. The vulnerabilities that GPU.zip exploited have by no means been fastened. As a substitute, the assault was blocked in browsers by limiting their capability to open iframes, an HTML ingredient that permits one web site (within the case of GPU.zip, a malicious one) to embed the contents of a web site from a distinct area.
Pixnapping targets the identical facet channel as GPU.zip, particularly the exact period of time it takes for a given body to be rendered on the display screen.