Finally: Google’s Android O to Fix a Major Phishing Security Hole in Android Devices

Android O

Google’s Android OS has been labeled as the most insecure, especially when speaking from Apple’s iOS corner. But according to Israel’s security firm Check Point, the upcoming Android O is set to make things a little better as far as security is concerned.

One of the major methods that phishing attackers depend on when they want to capture your personal information on Android devices is through app overlay. This is where you see one app having a functional window on top of another app, a feature that most of you must have seen on Facebook Messenger.

You might think that what you are typing is a password for your banking app, playing a game or entering your personal number into WhatsApp, but in reality, you might be giving out personal details to some criminal gang hiding behind their computers. This is possible through app overlay, but Google has tried controlling the security risks involved here by only allowing apps downloaded via the Play Store to actually overlay a screen on top of other apps.

As mentioned earlier, Facebook Messenger does this by displaying a screen on top of other apps when a notification comes in. But in order to add even stricter measures to this screen overlay functionality, the next Android O OS will be dialed back thus reducing the phishing threat on Android devices. Of course, this won’t completely put away the phishing attacks on Android O, but it will make it a bit harder for these chaps when they want to steal your personal data.

The Israeli-based security firm presented a report on May 9, claiming that Google is busy working on ways to contain threats resulting from screen overlay. This whole thing started with Android 6.0 Marshmallow where the search engine giant completely turned off the feature while at the same time asking users to authorize the feature manually when an app wants to overlay its screen on top of the another app. However, issues arose with legit apps such as Messenger – apps that legitimately use screen overlays to deliver notifications to users.

As a result of this issue, the search engine giant made a small tweak to the updated Android 6.0.1 Marshmallow, narrowing the security feature to only cover non-Play Store apps. In short, Google meant that any app downloaded from the Play Store can use the screen overlay feature without asking for authorization from the user. In case of non-Play Store apps, you’ll still have to manually authorize the app before it can overlay its screen on top of other apps.

Android O

Well, this is actually where the problem is. Apparently, non-secure apps have been finding their way into the Google Play Store. With the screen overlay feature, these malicious apps, when installed, will still be able to capture your personal details quite easily. You might be thinking that you are using a legit app when the reality is that you are giving out your personal details to the bad guys.

When Check Point pointed out this issue to Google, the tech giant confirmed that the issue will be taken care of with the release of Android O. Of course, users of the new Android O will still see app overlays, but this time, they’ll lie under the critical system windows, Google says. These windows include things like the status bar or on-screen keyboard, something Google believes will make screen overlays more obvious for Android users.

This is a great tweak from Google, but the question is how long will it take before this feature actually reaches all potentially vulnerable Android users across the globe? So far, Android 7.0 Nougat, which was released in 2016, has yet to reach 10% of all Android devices. Similarly, it will take Android O months before reaching to all supported devices. If you want to get this update as early as this year, you may have to switch allegiance to Google’s Pixel or Nexus family of devices, but as for other Android OEMs, the update to Android O may happen somewhere in 2018.

As you wait, you may want to ensure that the “Unknown sources” option in Security Settings is unchecked as this prevents installation of apps from outside the Google Play Store – apps that have high chances of installing phishing malware on your Android phone.