Android O will eliminate a major security vulnerability of Google’s omnipresent operating system that was introduced by Android 6.0.1 Marshmallow, cyber security firm Check Point claims. The flaw that enables a wide variety of malware is connected to the SYSTEM_ALERT_WINDOW permission that provides apps with the ability to overlay content over other apps without specifically notifying the user that they’re writing on the screen. The very nature of the permission makes it a serious security risk if it’s accidentally granted to a malicious app, though the main problem lies in the fact that the permission is de facto granted to all apps that are downloaded from the Google Play Store as of Android 6.0.1.
The Mountain View-based tech giant reportedly opted to facilitate the process of granting the permission due to the fact that non-malicious apps who legitimately needed it often weren’t able to function in an optimal manner as users would fail to grant them authorization in the system settings of their devices. While the Alphabet-owned company implemented certain safeguards that were designed to prevent the abuse of its mechanism, hackers reportedly still managed to find several ways to trick or completely bypass Google’s security measures and have their malware-enabling apps featured on the Google Play Store. The aforementioned permission was abused by 74 percent of Android ransomware and 57 percent of adware-infused apps on the Google Play Store, Check Point claims. Due to that state of affairs, Google will be patching the vulnerability related to the problematic permission by shipping Android O with TYPE_APPLICATION_OVERLAY, a new type of permission that will serve as an alternative to its predecessor but also prevent apps from overlaying any kind of data over “critical system windows.”
While the wording of the announcement doesn’t necessarily suggest that the Alphabet-owned Internet giant will be radically changing the process of granting the SYSTEM_ALERT_WINDOW permission, it seems that the company is still adamant to address the vulnerability by replacing the problematic authorization with a much more restrictive one whenever possible. By doing so, the company would minimize the chances of Android users falling victim to ransomware, adware, and other types of malware even if they accidentally download and authorize a malicious app.
Source : www.androidheadlines.com
