{"id":145046,"date":"2025-10-14T11:12:25","date_gmt":"2025-10-14T09:12:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-pixnapping-opredelyayushhaya-soderzhimoe-ekrana-dlya-perehvata-2fa-kodov-v-android"},"modified":"2025-10-14T11:12:25","modified_gmt":"2025-10-14T09:12:26","slug":"ataka-pixnapping-opredelyayushhaya-soderzhimoe-ekrana-dlya-perehvata-2fa-kodov-v-android","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/ataka-pixnapping-opredelyayushhaya-soderzhimoe-ekrana-dlya-perehvata-2fa-kodov-v-android","title":{"rendered":"A Pixnapping t\u00e1mad\u00e1s, amely a k\u00e9perny\u0151 tartalm\u00e1t hat\u00e1rozza meg 2FA-k\u00f3dok elfog\u00e1s\u00e1ra Android rendszeren.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00e9gy amerikai egyetem kutat\u00f3csoportja kifejlesztett egy Pixnapping t\u00e1mad\u00e1si technik\u00e1t (CVE-2025-48561), amely lehet\u0151v\u00e9 teszi az alacsony jogosults\u00e1g\u00fa Android-alkalmaz\u00e1sok sz\u00e1m\u00e1ra, hogy meghat\u00e1rozz\u00e1k a m\u00e1s alkalmaz\u00e1sok \u00e1ltal megjelen\u00edtett tartalmat. A t\u00e1mad\u00e1s gyakorlati alkalmaz\u00e1s\u00e1nak p\u00e9ld\u00e1jak\u00e9nt bemutatt\u00e1k a Google Authenticator alkalmaz\u00e1s \u00e1ltal megjelen\u00edtett k\u00e9tfaktoros hiteles\u00edt\u00e9si k\u00f3dok azonos\u00edt\u00e1s\u00e1t. Ugyanakkor bemutatt\u00e1k, hogyan alkalmazhat\u00f3 a t\u00e1mad\u00e1s bizalmas adatok kiemel\u00e9s\u00e9re, amelyeket a Gmail, a Signal, a Venmo \u00e9s a Google Maps alkalmaz\u00e1s haszn\u00e1lata k\u00f6zben jelen\u00edtenek meg. <\/p>\n

A k\u00e9perny\u0151tartalom meghat\u00e1roz\u00e1s\u00e1hoz egy pixel alap\u00fa elemz\u0151 m\u00f3dszert alkalmaztak, amelyet 2023-ban az ugyanazon kutat\u00f3csapat val\u00f3s\u00edtott meg a GPU.zip oldals\u00f3 csatorn\u00e1s t\u00e1mad\u00e1sban, \u00e9s amelyet el\u0151sz\u00f6r 2013-ban \u00edrtak le. A m\u00f3dszer l\u00e9nyege, hogy a GPU-ban l\u00e9v\u0151 optimaliz\u00e1l\u00e1sok miatt a m\u00e1r megjelen\u00edtett sz\u00ednhez hasonl\u00f3 sz\u00ednnel rendelkez\u0151 pixel renderel\u00e9se gyorsabban t\u00f6rt\u00e9nik, mint m\u00e1s sz\u00edn\u0171 pixel\u00e9. A pixel-renderel\u00e9si id\u0151k k\u00f6z\u00f6tti k\u00fcl\u00f6nbs\u00e9gek \u00e9rt\u00e9kel\u00e9s\u00e9vel \u00fajraalkothatjuk a k\u00e9perny\u0151n l\u00e9v\u0151 tartalmakat, \u00e9s egyfajta k\u00e9perny\u0151k\u00e9pet hozhatunk l\u00e9tre. <\/p>\n

A Pixnapping attack involves invoking the target application, overlaying it with its own window, and pixel-by-pixel analysis of the content while analyzing the execution time of graphical operations on each pixel. Such an analysis allows for a high likelihood of determining which pixels are white background and which are involved in displaying characters. To conceal pixel manipulations from the user, layers with masks are applied \u2014 during the attack, the content of the application window being attacked continues to be visually displayed on the screen. <\/p>\n

A t\u00e1madott alkalmaz\u00e1s aktiv\u00e1l\u00e1s\u00e1hoz \u00e9s a pixelek ablak\u00e1nak renderel\u00e9si csatorn\u00e1ba val\u00f3 eljut\u00e1s\u00e1hoz az Android-aktivit\u00e1sok k\u00f6z\u00f6tti v\u00e1lt\u00e1st intent-k\u00e9r\u00e9sek r\u00e9v\u00e9n v\u00e9gzik el. A t\u00e1madott alkalmaz\u00e1s ablaka felett f\u00e9lig \u00e1tl\u00e1tsz\u00f3 ablakok jelennek meg, kiemelve egyes pixeleket, \u00e9s grafikai m\u0171veleteket ind\u00edtanak el rajtuk a Window Blurs API seg\u00edts\u00e9g\u00e9vel. A pixel renderel\u00e9s\u00e9nek pontos idej\u00e9nek m\u00e9r\u00e9s\u00e9re VSync-hez k\u00f6t\u00f6tt callback-h\u00edv\u00e1sokat haszn\u00e1lnak.

\"A<\/center> <\/p>\n

The limitation of the previously proposed method GPU.zip was low performance \u2014 when attacking the browser, determining the name under which the user logged into Wikipedia on another tab took 30 minutes on the AMD Ryzen 7 4800U GPU and 215 minutes on the Intel i7-8700 GPU with an accuracy of 97-98%. In order to meet the 30-second interval for updating codes in Google Authenticator, the method was improved and optimized. The number of checks for each pixel was reduced from 64 to 16, and the delay between processing pixels was decreased from 1.5 seconds to 70 milliseconds. Scanning was performed not on the whole screen, but only on the area where Google Authenticator displays the code. <\/p>\n

The method was tested on Pixel 6, 7, 8, and 9 smartphones with Android versions 13-16 to determine 106 six-digit codes for two-factor authentication generated in Google Authenticator. The accuracy of code identification on the mentioned smartphones was 73%, 53%, 29%, and 53%, and the identification time was 14.3, 25.8, 24.9, and 25.3 seconds, respectively. On the Samsung Galaxy S25 smartphone, researchers were unable to stay within the 30-second interval due to noise from other applications, but attack variants on other applications were shown, for which there were no time limitations. The mechanisms used in the attack are not specific to individual smartphone models, and the attack potentially affects any Android devices.