Watch out for “START NOW” dialogs in Lollipop

Malicious Android app can take screenshots of other apps without your permission if you tap “START NOW” on a seemingly innocent dialog.

This is a result of an everlasting Android “tapjacking” vulnerability which allows for malicious apps to obscure other apps or system dialogs. The video below presents the vulnerability demo app.

At the moment I’m not releasing the sources of this demo app because the fix is not widely adopted yet and I don’t want to make life easier for someone wanting to use it in a real attack.

I decided to publicize this security issue because Google Security Team (after changing their mind couple times) decided that this is a Low severity issue and they are not planning to release a fix for Android 5.0 and 5.1.

Majority of Android devices still haven’t received Lollipop so it sounds reasonable to release a fix before they get an update instead of waiting for next major release which may not happen for another year. Given how simple it is to implement an interim fix, I can’t see a reason for not doing this other than incompetence.