New Technology Detects Hidden Malware on Android Phones

Accessibility Tools: A Double-Edged Sword for Smartphone Security

Accessibility tools like screen readers and voice-to-text have improved smartphone usability for people with disabilities, but they can also be misused by hackers.

Malware can exploit these services to access screen content and carry out unauthorized actions, such as clicking buttons, approving payments, or preventing removal of the malware. This can result in serious issues, including unauthorized bank transfers or stubborn infections that resist uninstallation.

“Phishing links or downloading harmful apps, even from trusted sources like the Google Play Store, often install such malware.” Once active, it can target sensitive apps like crypto wallets and ride-hailing platforms that hold payment data.

Researchers at Georgia Tech have created a cloud-based tool called Detector of Victim-specific Accessibility (DVa) to detect malware on smartphones. DVa scans the device remotely and provides users with a detailed report identifying malicious apps and offering guidance on how to remove them.”It also shows which legitimate apps attackers targeted and advises users on how to contact those companies to assess potential harm.” Additionally, DVa reports its findings to Google to help the company eliminate the malware from affected apps.

“As we build increasingly accessible systems, it’s crucial to involve security experts in the process,” said Brendan Saltaformaggio, associate professor in the School of Cybersecurity and Privacy and the School of Electrical and Computer Engineering. “Otherwise, hackers will exploit these tools.”

Georgia Tech and Netskope Test Malware Resistance

To assess smartphone vulnerability to this kind of attack, the team conducted a malware analysis using five Google Pixel phones. Partnering with cybersecurity firm Netskope, the Georgia Tech researchers aimed to enhance mobile protection against advanced malware threats. They installed sample malware on each device to observe its impact and used DVa to document and analyze the malicious behavior.

Although DVa is effective at detecting ongoing attacks, the researchers acknowledge a key challenge: removing malware without disrupting legitimate accessibility features.

“In the future, we need to better understand how accessibility services operate to distinguish between normal and malicious use,” said Haichuan (Ken) Xu, a Ph.D. student in the School of Cybersecurity and Privacy.

Read the original article on: Scitech Daily

Read more: EU’s Highest Court Ruling on Android Auto Antitrust Case Could Accelerate Interoperability Demands