{"id":145046,"date":"2025-10-14T11:12:25","date_gmt":"2025-10-14T09:12:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-pixnapping-opredelyayushhaya-soderzhimoe-ekrana-dlya-perehvata-2fa-kodov-v-android"},"modified":"2025-10-14T11:12:25","modified_gmt":"2025-10-14T09:12:26","slug":"ataka-pixnapping-opredelyayushhaya-soderzhimoe-ekrana-dlya-perehvata-2fa-kodov-v-android","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/ataka-pixnapping-opredelyayushhaya-soderzhimoe-ekrana-dlya-perehvata-2fa-kodov-v-android","title":{"rendered":"Pixnapping attack, which determines screen contents to intercept 2FA codes on Android","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A group of researchers from four American universities developed a Pixnapping attack technique (CVE-2025-48561) that allows unprivileged Android applications, which do not request additional permissions, to determine the content displayed on the screens of other applications. As a practical example of the attack, the method demonstrated the ability to identify two-factor authentication codes shown by the Google Authenticator app. The attack has also been shown to extract sensitive data displayed on the screen while working with Gmail, Signal, Venmo, and Google Maps. <\/p>\n

To determine the screen content, a pixel-by-pixel analysis method was used, implemented in 2023 by the same research team in the GPU.zip side-channel attack, which was initially described back in 2013. The essence of the method is that due to the optimizations present in the GPU, drawing a pixel with a color matching a color already displayed on the screen is faster than drawing a pixel with a different color. By assessing the time difference in rendering pixels, it is possible to reconstruct the existing screen content and create an approximation of a screenshot. <\/p>\n

The Pixnapping attack involves invoking the target application, overlaying it with its own window, and pixel-by-pixel analyzing the content by assessing the execution time of graphic operations on each pixel. This analysis allows for a high probability determination of which pixels have a white background and which ones are used to display characters. To conceal pixel manipulation from the user, layers with masks are overlaid \u2014 during the attack, the content of the application window from which the attack is conducted continues to be visually displayed on the screen. <\/p>\n

To activate the targeted application and get pixels from its window into the rendering pipeline, switching between Android activities is performed using intent requests. Semi-transparent windows are displayed over the attacked application's window, highlighting individual pixels and initiating graphical operations on them using the Window Blurs API. Callback calls tied to VSync are used to measure the exact pixel rendering time.

\"Pixnapping<\/center> <\/p>\n

The limitation of the previously proposed method GPU.zip was low performance \u2014 when attacking a browser, identifying the name under which the user logged into Wikipedia in another tab took 30 minutes on an AMD Ryzen 7 4800U GPU and 215 minutes on an Intel i7-8700 GPU with 97-98% accuracy. To fit within the 30-second code refresh interval in Google Authenticator, the method was improved and optimized. The number of checks per pixel was reduced from 64 to 16, and the delay between processing pixels was decreased from 1.5 seconds to 70 milliseconds. The scanning was conducted not over the entire screen but only in the area where Google Authenticator shows the code. <\/p>\n

The method was tested on Pixel 6, 7, 8, and 9 smartphones with Android versions 13-16 to determine one hundred six-digit codes for two-factor authentication generated in Google Authenticator. The accuracy of code identification on the noted smartphones was 73%, 53%, 29%, and 53%, with identification times of 14.3, 25.8, 24.9, and 25.3 seconds, respectively. On the Samsung Galaxy S25 smartphone, researchers were unable to fit within the 30-second interval due to noise generated by other apps, but attack variations on other applications were demonstrated, which had no time restrictions. The mechanisms used in the attacks are not specific to individual smartphone models, and the attack potentially affects any Android devices.