Android 13, already found a way to circumvent the new security measures

Android 13 has been released in stable form on the Pixels just a few days ago, but the first ones are already reported security abuses passing (as usual) through i accessibility services, although Google had done a lot to strengthen them (however, causing several problems for legitimate apps such as Tasker and beyond). According to Threat Fabric, the first to develop a working exploit are some members of the group of cybercriminals known as Hadoken Security.

To summarize the situation very briefly: the accessibility services, by their nature, must connect to very delicate and deep areas of the operating system to function properly. For this reason, with Android 13, Google has decided to preclude access to any manually installed app (sideloading) from sources external to app stores (not only the Play Store, but also competing ones such as Amazon or F-Droid) unless you complete a rather long and laborious series of steps, specifically designed to discourage less users. experts.

⬇️↘️➡️✊Hadoken! TF spotted #Bugdrop the first #Android Dropper Trojan trying bypass Android 13 restrictions.

So what did the evildoers think? Great, since apps downloaded from any app store can still interface normally to accessibility services I create a two-part malware – a first part disguised as an app store a “dropper” whose only job is to install the second part that contains the actual malware, which is unrestricted and can connect to accessibility services with a single tap.

It is important to understand that for cybercriminals the “ease of use” of their software is perhaps even more critical than for legitimate developers. As the number of steps the victim has to take to activate the malware decreases, the chances of success increase significantly. ThreatFabric, which managed to recreate a proof-of-concept similar to that of Hadoken Security, dubbed the BugDrop threat. The name is actually good news: it comes from the fact that malware at this stage is still extremely unstable and malfunctioning, and therefore has limited damage capabilities for now. But the message is clear: Google needs to act quickly, and crush this threat before it becomes truly dangerous.