User beware: Researchers have 92% success rate hacking into Gmail app
Your smartphone may be far less secure than you think. A group of computer scientists say they’ve found a way to hack into six out of seven popular apps like Gmail on Android, Windows and iOS platforms, with a success rate of up to 92 percent.
The weakness, which was discovered by researchers from the University of California Riverside, means they could get potentially sensitive information, such as looking at emails and changing passwords. Thankfully for unsuspecting citizens, the team says it has no interest in using any personal data, but will instead present its findings in a paper: “Peeking into Your App without Actually Seeing It: UI State Inference and Novel Android Attacks,” at the USENIX Security Symposium in San Diego on Friday.
The team believed they could find a fault in an app because so many are produced by so many different developers. Once a user downloads a number of apps to his or her smartphone they are all running on the same shared platform, or operating system. Therefore users leave themselves open to attacks as an Android phone allows itself to be hijacked or pre-empted.
"The assumption has always been that these apps can't interfere with each other easily," said Zhiyun Qian, one of the authors of the paper and a member of the University of California Computer Science and Engineering Department. "We show that assumption is not correct and one app can in fact significantly impact another and result in harmful consequences for the user," the phys.org website reported him as saying.
The research team managed to carry out their attacks via a newly-discovered shared-memory side channel, which exists in nearly all popular Graphical User Interface (GUI) systems, the study stated. The public side channel details the shared memory statistics of other processes. The key for the team was to try and see what the user was doing, so they could get their timing just right to log on at the exact same moment as the user.
Once they could see what the user was doing, they would be able to enter the app and extract whatever the data they wanted. The researchers gave the example of the CHASE app, where they were able to control the user’s camera forcing it to take a second picture of the cheque, which would be then sent to them.
In all the team tried to access seven apps, with Gmail and H&R Block proving the easiest to hack with a 92 percent success rate. On the other hand, Amazon was by far the hardest with just a 48 percent success rate. According to Phys.org, Amazon was much more difficult to gain entry to because the app allows one activity to transition to almost any other activity, increasing the difficulty of guessing which activity it is currently in.
The research team said in their paper that they would recommend ways to try and eliminate the side channel, and would suggest more secure system designs. However, Qian had some simple advice how not to get caught out: “Don't install untrusted apps,” he said, but also admitted that there will also need to be a balance in making a device functional, yet secure.
