Skip to content

MASTG-DEMO-0x01.md

Latest commit

 

History

History
32 lines (22 loc) · 1.19 KB

MASTG-DEMO-0x01.md

File metadata and controls

32 lines (22 loc) · 1.19 KB
Raw
platform android
title Password Exposed Through Accessibility Metadata
id MASTG-DEMO-0x01
code
kotlin
xml
kind fail
test MASTG-TEST-0x01

Sample

The sample displays a password input whose characters are visually masked. An accessibility delegate intentionally copies the underlying plaintext into the node's content description, making the value observable through accessibility while it remains visually concealed.

{{ MastgTest.kt # AndroidManifest.xml }}

Steps

  1. Use @MASTG-TECH-0005 to install the app on a device.
  2. Install and enable the attacker app from @MASTG-DEMO-0x02.
  3. Open this app and tap Start.
  4. Enter MASTG-SECRET-1234 into the password field.
  5. Use @MASTG-TECH-0009 to obtain the output generated by the attacker accessibility service.

Observation

The password characters are visually masked in the victim app, but the attacker accessibility service reports MASTG-SECRET-1234 in the node's accessibility metadata.

{{ ../MASTG-DEMO-0x02/output.txt }}

Evaluation

The test case fails because the visually masked password is exposed in plaintext through accessibility metadata to an accessibility service that is not declared as an accessibility tool.