Skip to main content

Malicious hackers could exploit flaws in Android for Work to nab sensitive data

android 23 gingerbread deprecated for work
wutlufaipy/123RF
One of the pillars of Google’s enterprise-focused “work features in Android platform,” previously called Android for Work, is security. But a newly discovered exploit demonstrated at the RSA conference in San Francisco on February 16 showed how an attacker could view, steal, and even manipulate content on a corporate Android smartphone without tipping off IT administrators.

The flaw, discovered by Yair Amit, chief technology officer of cybersecurity firm Skycure, has to do with the way Android for Work handles “sandboxes,” or protects user profiles. The service operates on the idea of a “work” profile with business-level controls, enterprise applications, corporate email, and secure documents on a smartphone or tablet. This secure profile effectively acts as a separate user, though it shares icon badges and notifications with the personal profile.

This concept of sandboxing — creating a secure container where apps outside the work profile can’t access data inside it — is key to Android for Work’s conceit. But it isn’t bulletproof.

One potential line of attack involves Android’s notifications framework. Incoming Android for Work messages are designated with a red briefcase icon in Android’s notifications window, giving the impression that they remain segregated from those in the personal profile.

But notifications on Android are a device-level permission, meaning apps in the personal profile can potentially manipulate the content of notifications from the work profile. Malicious software could view sensitive incoming work emails, calendar appointments, file attachments, and other messages, for example, and could transmit that information to a remote server.

The second line of attack exploits a flaw in Android’s Accessibility Service, the Android component that provides usability enhancements for impaired users. It necessarily has access to virtually all of Android’s content and controls, making apps that acquire permission to use it particularly dangerous — and difficult to detect. For instance, an app could use Android’s Draw Over Apps feature, which allows apps to lay text and graphics on top of other apps, to trick a user into activity Accessibility Service or Notifications without their knowledge.

That’s not to suggest the attacks can’t be mitigated. Android 6.0 Marshmallow requires users to manually allow apps to create system overlays by changing permissions in the settings menu. And the Notifications attack requires a user to grant extraordinary permissions to an installed app. Still, Amit notes the relative ease of circumventing Android for Work’s sandboxing method by exploiting the “illusion” of security.

“The interesting thing about both of these […] methods of defeating the Android for Work profile separation is that the device and the Android operating system remain operating exactly as designed and intended,” Amit said.

“It is the user who must be tricked into placing the software on the device and activating the appropriate services that allow the malware access to sensitive information. [The] illusion of a secure container […] tends to allow people to let their guard down in the belief that the environment itself is a sufficient security mechanism to protect data.”

Editors' Recommendations

Kyle Wiggers
Former Digital Trends Contributor
Kyle Wiggers is a writer, Web designer, and podcaster with an acute interest in all things tech. When not reviewing gadgets…
Best Fitbit Cyber Monday deals: Save on Fitbit Sense 2 and more
Digital Trends Best Cyber Monday Fitbit Deals

With the arrival of Cyber Monday deals, purchasing a new smartwatch just got more affordable. If you're looking for a cheap but dependable brand, Fitbit is one of our favorites, especially if you want a smartwatch with a focus on fitness. We've rounded up the best deals below, but make sure you compare these to Cyber Monday Apple Watch deals, and Garmin Watch Cyber Monday deals.
Best Fitbit Cyber Monday deals

Fitbit Ace 3 --

Read more
77 best Amazon Cyber Monday deals on laptops, TVs, and more
Digital Trends Best Black Friday Amazon Deals

You can make a strong case that Amazon won Black Friday. Now that we've moved on to Cyber Monday, Amazon is still looking strong. We've collected the best Cyber Monday deals on a wide variety of products. If you're interested in grabbing some new tech today, like an OLED TV, some smart home devices, or just a new coffee maker, check out the awesome deals below.

Best Amazon Cyber Monday TV deals

Read more
Samsung Cyber Monday deals: TVs, tablets, smartphones, and more
Stack of Samsung Galaxy S22 phones.

Samsung is behind a lot of different electronic devices in the market, like TVs, monitors, smartphones, tablets, and refrigerators. It's among the most trusted names in the consumer electronics industry, with offerings that range from budget to premium, and you can secure discounts across the board through the Cyber Monday deals that have launched. You're going to have to act quickly though, because there's always high demand for Samsung Cyber Monday deals. We've gathered some of our favorite bargains below to help you decide fast, but it's also worth checking Samsung has on sale by clicking on the button below.

Samsung TV Cyber Monday deals

Read more