Demystifying the prevalence and impact of screenshot attacks in android apps

다국어 초록 (Multilingual Abstract)

Android apps handle sensitive data, often displayed on screens (i.e., Activities), and protecting these activities is vital for ensuring user privacy. Several studies have demonstrated the risk of private data leakage via screen capture and identified malware exploiting this vulnerability. To mitigate such threats, Google introduced FLAG_SECURE, an activity-level security feature that protects an Activity when set by blocking screen capture and restricting display on non-secure devices. Proper usage of this security feature could significantly reduce data leakage risks. However, to the best of our knowledge, its adoption across diverse Android apps has not been systematically studied, and this work aims to address this gap.
We present ASSA, a static analysis framework for detecting Android apps vulnerable to screenshot-based attacks. ASSA constructs UI models of activities and fragments to capture simplified screen information, including UI components as well as statically and dynamically displayed content. It considers both statically defined strings in XML resources and dynamically constructed strings through APIs. To assess vulnerability, ASSA leverages a Large Language Model (LLM), which infers screen context and determines whether the screens contain sensitive user information. Finally, ASSA identifies activities that display sensitive information without the FLAG_SECURE protection. Using our tool, we evaluated 5,667 apps and found that 19.8% contained at least one activity with sensitive data but were not protected. Furthermore, 87.2% of apps failed to apply FLAG_SECURE to any activity, leading to potential leakage of credentials, financial data, and location information. In total, 20 vendors confirmed our findings; 6 committed to fixes, 9 acknowledged the issues and planned further investigation, and the remainder acknowledged the issues without outlining remediation plans. These results expose the widespread prevalence of these vulnerabilities and emphasize the urgent need for stronger developer practices.

목차 (Table of Contents)

• 1. Introduction 1
• 2. Background and Motivation 4
• 2.1 Android User Interface 4
• 2.2 Text Rendering APIs 5
• 2.3 FLAG_SECURE Window Flag 6
• 3. Activity UI Models 7
• 3.1 UI Model Generation 7
• 3.2 Frontmatter Modification 8
• 4. Vulnerability Analysis 11
• 4.1 Analysis Pipeline 11
• 4.2 LLM Prompt Design 12
• 4.3 Secure Flag Detection 13
• 5. Evaluation 16
• 5.1 Dataset 16
• 5.2 RQ1: Ration of Vulnerable Apps 17
• 5.3 RQ2: Types of Leaked Data 19
• 5.4. RQ3: Types of Secure Activities 23
• 5.5 RQ4: Performance of ASSA 26
• 5.6. RQ5: Impact of LLM 29
• 6. Case Studies of Private Data Leaks 32
• 6.1 Contact Information 32
• 6.2 Financial Information 33
• 6.3 Communication Information 33
• 6.4 Account Credentials 35
• 6.5 Personal Artifacts 36
• 6.6 Device Information 37
• 6.7 Location Information 37
• 6.8 Health Measurements 38
• 7. Discussion and Limitation 40
• 8. Related Work 43
• 9. Conclusion 46