TapTrap: Animation-Driven Tapjacking on Android
summary
TapTrap is an animation-driven tapjacking that lets zero-permission apps supply custom entry animations to make a launched victim activity transparent or massively scaled so touches target hidden buttons. The authors build an analyzer with APKTool and Robolectric to reconstruct animations, compute opacity/scale scores, and scan 99,705 Play Store apps, finding 76.3% of apps vulnerable, 7% of activities affected, 28 apps with score ≥50 (no live abuse found), and a 20-participant user study where every participant misses at least one variant; two CVEs assigned.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:32Android Activities basics
- 2:16Traditional tapjacking
- 3:39Current mitigations limits
- 4:01TapTrap mechanism
- 6:07Animation properties
- 6:49System apps and permissions
- 7:32Browser vulnerabilities
- 8:17Third-party app analysis
- 9:21Wild exploitation?
- 11:46User study on stealth
- 13:32Mitigations against TapTrap
- 14:16Summary
related talks
24mRecent Mobile App Security Incidents from Real-World Cases
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
42mIf 6,000 Mobile Malware Applications Could Talk! Ow, They Do, And A Lot!
32mHacking the Hackers’ Code: Inside Android Malware
15mBest practices for shielding mobile apps from emerging threats
45mI just hacked your app!
56mModern Android Hacking
53mAndroid: He protec, but he also attac