How does a screen overlay work?

A screen overlay is a feature on newer smartphones that allows one app to display on top of another app. This can be used to quickly check alerts and notifications from messaging, email, and social networking apps without having to switch between apps.

What Is a Touchscreen Overlay?

Touchscreen overlays are becoming more and more common. You can now find them on TVs, computer monitors and other display devices. Even if a display device doesn’t feature native support for touch commands, you may still be able to control it via touch by investing in a touchscreen overlay. So, what is a touchscreen overlay exactly, and how do they work?

Touchscreen Overlays Explained

Some touchscreen devices are designed with an overlay layer, but this isn’t necessarily the same as an actual touchscreen overlay. Overlay layers are included in the touchscreen device’s design, consisting of a glass or flexible plastic layer that’s attached over the surface of the device. A touchscreen overlay, on the other hand, is a separate accessory that’s installed over the surface of a display device to provide it with touchscreen functionality.

The Basics of Touchscreen Overlays

The primary purpose of a touchscreen overlay is to transform a display device — computer monitor, TV, human machine interface (HMI), etc. — with touchscreen functionality. Some display devices are designed with native support for touch-based input. Others, however, lack this support. But even if a display device doesn’t support touch-based input, you may be able to add this feature to the device using a touchscreen overlay. The overlay is installed over the device’s display, at which point it allows you to control the device using touch commands.

There are different types of technologies powering touchscreen overlays, the most common of which is infrared (IR). With an IR overlay, light is emitting across the surface, and there are sensors or cameras present to detect disruptions in this light. When you touch the surface, you’ll disrupt the flow of light, allowing the overlay to pinpoint the location of your touch command.

Pros and Cons of Touchscreen Overlays

The greatest benefit of touchscreen overlays is its ability to easily add touchscreen functionality to display devices lacking such functionality. Once the overlay is installed and connected to the device, you’ll be able to control the device using touch commands.

Touchscreen overlays are also relatively inexpensive, making them a popular choice for business owners looking to upgrade a large quantity of display devices with touchscreen functionality.

On the other hand, touchscreen overlays don’t offer the same accuracy, responsiveness and overall quality as touchscreen devices with native support for touch-based input. Most touchscreen overlays are less accurate and respond more slowly than actual touchscreen devices.

How To Fix Screen Overlay Detected Issue On Android

If you are an Android user, you must be aware of the common issues an Android user faces. One of them is screen overlay detected error message. If you are facing the same issue, you are at the right place.

But before we fix this problem, we should know precisely what this Screen Overlay Detected” error message is and why this Android screen overlay issue occurs.

What Is Android Screen Overlay Detected?

Typically, a pop-up message with the message “To change this permission setting, you first have to turn off the screen overlay from Settings > Apps” displays when the problem “Screen Overlay Detected” occurs.

Applications can draw over the other programs using the screen overlay feature, which enables them to function even when another app is open. Consider the chat heads on Facebook Messenger, which can appear while you are engaged in another activity to inform you that you have got a message.

Why does Android Screen Overlay Detected Issue Occur?

If you see a ‘Screen overlay detected’ notification from Google, then it means something is trying to trick your operating system into giving up access to sensitive information. It could be malware, spyware, or another kind of malicious code exploiting a security flaw in the way your device handles overlays — temporary windows that appear on top of other apps to provide more information or functionality.

The feature could be misused to conceal info from users and manipulate them into accepting or paying for things they would otherwise not. Before making crucial decisions on your device, ensure the screen overlay is switched off by following the instructions in the error message.

With that out of the way, let’s jump straight to the screen overlay fix process.

How To Fix Screen Overlay Detected Error On Android?

To fix the screen overlay detected issue follow the steps:

• Open the “Settings” app on your phone.
• Now scroll down a bit and tap on “Apps & notifications.”

• In Apps & notifications window, look for and click “Special app access.”

• Now under special app access, locate and tap on the “Display over other apps” option.

• Now a list of apps will appear in front of you. Click on these apps one by one and turn off the toggle button to disable the “Allow display over other apps” option.

To Wrap This Up

So, this is how you can fix screen overlay detected error on Android. And remember that this screen overlay detected can occur on any Android device that supports this feature. Thankfully, Google made it incredibly simple to identify the offending app in Android with a simple message that explains exactly what is overriding other applications. That’s it for now! We’ll see you soon with another informational blog like this.

• 
  

How Attackers Use Overlay Attacks to Commit Mobile Fraud

Here at Appdome, we’ve seen a rise in cyber-criminals creating and using screen overlay attacks against mobile apps to commit mobile fraud. On-device malware and mobile fraud have grown to become two of the biggest threats on the mind of mobile consumers. In Appdome’s most recent Global Mobile Consumer survey about mobile app security expectations, mobile fraud took the #1 spot as the biggest fear on the minds of consumers, and malware shot up 121% to take the #2 spot.  The best defense against mobile fraud is to prevent it from occurring in the first place. This blog will discuss how overlay attacks work and what mobile developers and cyber professionals can do to detect and defeat overlay attacks.

What is a Screen Overlay Attack?

A Screen Overlay Attack is an attack technique in which part of the application screen is covered by a fake (malicious) screen that the user is tricked into clicking on or interacting with. There are a huge number of variants of overlay attacks, but in all overlay attacks the user thinks they are interacting with a legitimate app or service, but they are actually interacting with the overlay screen controlled by the attacker. The classic example of this type of attack is the Cloak & Dagger type of attack. More recent variants include Strandhogg and others.

Common Screen Overlay Attacks

While the technical methods of achieving a screen overlay attack vary widely, all overlay attacks can be summarized into three types:

1. Data Harvesting, Input Capture Attack

Data Harvesting or Input Capture Attack is a technique used by an attacker to access and retrieve PII, transaction or other data when the user interacts with an exploited mobile app. This can be accomplished by covering part or all of a mobile app screen with a fake screen controlled by the attacker. In this variant, an overlay of a fake screen could transparently cover part or all of the real screen, hide the real screen from the user’s view, or interrupt the mobile app’s workflow, asking the victim to enter information (usually sensitive info like usernames, passwords, pin codes, or answers to “security questions”). The victim thinks they are entering their information into the legitimate mobile app, but in reality, they are entering data into the malicious overlay screen and, only then and only if needed, into the legitimate mobile application screen beneath the overlay screen. This technique has been very common in mobile banking apps, fintech apps, eWallets, and cryptocurrency apps as part of synthetic ID fraud. 

2. Mobile Malware Delivery 

In other variants of screen overlay attacks, the attacker may not be after information. The attacker might instead want the user to install or enable malware on the device. To make this easier to achieve, attackers often trick users to enable otherwise legitimate Android functions like Accessibility Services or installing apps from an unknown source. For example, the attacker might present a fake screen with the logo of the exploited app and trick the user into enabling Accessibility Services or Unknown Sources. With these features enabled, the attacker has an easier way to deliver malware onto the mobile device and bypass Google Play security measures. Once either Android feature is enabled, it stays enabled until the user explicitly turns it off. Or the attacker might trick the user into approving mobile app permissions which the malware will then abuse for its own purposes. 

3. Mobile Privilege Escalation

Attackers can also escalate privileges by tricking users into approving dangerous “app permissions” that the malware app seeks to abuse. With an overlay attack, the user thinks she is approving the permission for the legitimate app but in reality, it is needed and used by the malware app. The permissions granted can be anything the mobile device allows, such as access to the camera, location, microphone, contact lists, SMS, and much more. Once granted, these permissions can be used by a malicious app running in the background. Sometimes the malicious fake app hijacks the real app (by abusing legitimate functions like Android “tasks“), and pushes itself into the foreground. It then impersonates the real app and requests permissions from the user. If the user approves the permissions, the permissions can be used by the malware to launch other attacks.  

Recent examples of overlay malware discovered by security researchers have used different combinations of attack methods. One such example is an overlay attack whereby users are tricked into installing malware that presents itself as a mandatory security patch that the user must install. In the screenshot below, the user thinks they are clicking ‘Continue’ to install a security patch. But in reality, they are actually clicking an ‘Activate’ button (hidden underneath the fake screen overlay) which activates the malware and grants it administrative privileges, which the attacker can then use to (1) lock the user out of their device by changing the passcode and (2) encrypt and/or delete the user’s data. This is a perfect setup for a ransomware attack. 

Can API 31 Stop Overlay Attacks?

With Android API 31 (Android 12), Google released a feature to protect mobile apps against overlay attacks. The good news is that using this feature will prevent non-system overlays from obscuring in-app views on recent Android versions. However, to use this feature, the developer of the relevant component must use API 31 (not earlier) and call the method “setHideOverlayWindows(true)” on each activity view to be protected. This makes the job of protecting specific Android activity views tedious and hard to manage, specifically since some of the sensitive workflows are not controlled explicitly by the developer. And, the method itself is not tamper resistant. By itself, the methods can be bypassed using any standard mobile app pen testing or dynamic hacking tool such as Frida or Magisk, which means malware can do the same.

How Does Appdome Stop Overlay Attacks?

Inside Appdome’s Cyber Defense Automation platform sits a Mobile Fraud Prevention solution that includes an advanced defense to Block App Overlay Attacks. This offers mobile app developers and cyber professionals a quick, easy, no-code and automated way to stop overlay attacks and mobile fraud at the source, inside the protected mobile app. Appdome’s Block App Overlay Attacks provides all the protection of API 31 across all Android API levels and an active threat-detection method to ward off tampering, injection, hooking and swizzling the defense. Enforcement against overlay attacks can be combined with Threat Scores, ThreatScope, Agentless Mobile XDR threat monitoring and intelligence as well as Threat-Events, advanced UX/UI intelligence and control. Everything is fully automated in the mobile DevOps CI/CD pipeline, eliminating work, complexity and time to defeat overlay attacks.