Recently I had to perform a couple of mobile application penetration tests against hybrid applications developed with Apache Cordova.
Both the applications were subject to Tapjacking attacks. Since the Tapjacking is nowadays a well know issue I thought there was already an easy solution for hybrid applications developed with Cordova (eg. via plugin), but unfortunately, I was wrong.
So, I decided to implement a solution to provide it to our customers and to anyone who needs it, through the release of a free and open source Cordova plugin.
The short answer: Cordova hybrid apps do not get tapjacking protection out of the box. Tapjacking is the mobile version of clickjacking: a malicious app draws a transparent overlay on top of your app and passes the user’s taps through to it, so the victim triggers actions without realising. Native Android apps can block this by setting filterTouchesWhenObscured to true, but a Cordova app has to protect its WebView. We released a free, open-source plugin, TapjackingProtectionPlugin, that adds that protection with a single command and no configuration.
What is Tapjacking?
I don’t want to write another article about tapjacking, so just few words for those who have never heard of it: the word is the combination of “tap” and “jacking” and, as the term suggests, it means someone hijacking what a user taps on his smartphone. It is a sort of mobile version of the “Clickjacking” for web applications.
For example, using social engineering an attacker can develop a malicious app that exploits tapjacking and tricks the victim into doing dispositive actions on vulnerable applications.
Put simply, to develop a malicious app the attacker leverages a popup window functionality provided by Android, called “toast”, that could be totally customized.
The peculiarity of this element is that any taps on it will be passed on the underlying element. So, the malicious app can:
- create a “toast” that covers the whole screen
- launch, using an intent (another Android functionality), the target application.
Now, if the victim taps on the popup, that might seem like a real app, the touch is passed to the target app.
In the following screenshot it is possible to see an example in which the target app (devloped with Cordova) is covered by some elements that are created by the “malicious” app using a customized toast.
In the preceding screenshot, despite the hand logo is above the button, if the user taps on it the touch is passed to the target application, and the action associated with the button is performed (the “ACTION DONE!” div is showed, but obviously it may be a dispositive critical action).
By the way, the “malicious” app used here does not require any permission and the test was done on Android 6.0.1 version.
How do you prevent tapjacking in a Cordova app?
| Platform | How to block tapjacking |
|---|---|
| Native Android | Set filterTouchesWhenObscured to true (or implement onFilterTouchEventForSecurity()) |
| Cordova (hybrid) | Protect the WebView, e.g. with the TapjackingProtectionPlugin |
Developers of native applications can easily prevent this attack ensuring that the setting “filterTouchesWhenObscured” is set to true, or that the method “onFilterTouchEventForSecurity()” is implemented.
For Cordova applications, it is necessary to protect the main WebView, in order to ensure that Android will discard touches when the WebView is obscured by another visible window.
So I developed the “TapjackingProtectionPlugin”, a free and open source plugin, that can be integrated inside any Cordova application to ensure protection against Tapjacking.
It does not require any configuration, you have only to add it with the following command:
cordova plugin add cordova-plugin-tapjackingprotectionand in few seconds your application is protected!
Note: this was tested at the time of writing on Android 6.0.1. Both the attack and the protection can depend on the Android and Cordova versions in use, which may have changed since, so treat the details here as version-specific: protect the WebView regardless of the current exploitability, and re-check the behaviour, and that the plugin still suits your setup, against the Android and Cordova versions you actually target.
Key takeaways
- Tapjacking is mobile clickjacking: a malicious app overlays your app and passes the user’s taps through, with no special permissions needed.
- Native Android apps block it with
filterTouchesWhenObscured; Cordova apps have to protect the WebView. - Our free, open-source TapjackingProtectionPlugin adds that protection to any Cordova app with one command and no configuration. Confirm it still fits the Android and Cordova versions you target.
Be sure to develop secure apps. BeDefended.
Thanks for reading.
