Repository navigation
fill MASTG-KNOW-0107-Detection Mechanisms - #3891
simge-yigit wants to merge 5 commits into
Conversation
|
Thank you @simge-yigit . I've assigned @TheDauntless to review this PR. Please have some patience, we currently have a very heavy workload including the porting of the MASTG from V1 to V2, the preparations for the OWASP MAScon next week and our day jobs. We'll hopefully be able to start reviewing non-V2 porting PRs starting beginning or mid July. Thanks for your understanding. We really appreciate your willingness to contribute to the MASTG. |
|
Thank you very much for the update. I wish you all the best with MAScon and the V2 migration. I’m currently reviewing the repository structure, and I hope I’ll be able to contribute to the transition as well. |
|
|
||
| This mechanism only reports that a screenshot was taken; it does not provide the captured image itself to the application. Therefore, the application must determine from its own state what content was being displayed at the moment the screenshot was taken. | ||
|
|
||
| ScreenCaptureCallback only reports screenshots taken by the user using the device's standard screenshot mechanism (for example, a hardware key combination). It does not report screenshots taken via adb or screenshots generated with other tools that capture the current screen content. Additionally, since the callback operates on a per-activity basis, only screenshots taken while the registered activity is visible can be detected. |
There was a problem hiding this comment.
Please mention, that AccessibilityService.takeScreenshot() is also not detected. Third party screenshot apps are known to use this method.
Official Android API Reference for Activity.ScreenCaptureCallback: developer.android.com/reference/android/app/Activity.ScreenCaptureCallback
Official Android API Reference for AccessibilityService.takeScreenshot: developer.android.com/reference/android/accessibilityservice/AccessibilityService.TakeScreenshotCallback
Please also reference:
Official Guide on Screenshot Detection: developer.android.com/about/versions/14/features/screenshot-detection
|
|
||
| An application can indirectly detect that a screenshot has been taken by monitoring new images added to shared storage. For this, a [ContentObserver](https://developer.android.com/reference/android/database/ContentObserver "android.database.ContentObserver") is registered to the [MediaStore](https://developer.android.com/reference/android/provider/MediaStore "android.provider.MediaStore") image collection, or a [FileObserver](https://developer.android.com/reference/android/os/FileObserver "android.os.FileObserver") is registered to the directory where screenshots are saved. When a new image file is created while the application is running, it becomes aware of this change and tries to determine whether it is a screenshot by examining the display name or relative path of the file. This determination is generally made through heuristic methods based on the presence of phrases like "Screenshot" in the file name or directory path. | ||
|
|
||
| For this approach to work, media reading permissions such as READ_MEDIA_IMAGES are required. Furthermore, only screenshots saved to storage can be detected; captures that are not written to disk cannot be detected with this method. Since the detection process relies on file name and directory structure, the accuracy of the heuristic methods used may vary depending on how the device manufacturer names screenshots and in which directory they store them. |
There was a problem hiding this comment.
By default, a ContentObserver fires for screenshots of any app, including while ours is backgrounded, and the event arrives only after the file is written. Also, on Android 14+ users can grant partial media access (READ_MEDIA_VISUAL_USER_SELECTED), and Google Play's photo-and-video permissions policy requires justification for broad READ_MEDIA_IMAGES access, which might not pass detecting screenshots.
Co-authored-by: David W. <davidw.software@gmail.com>
|
|
||
| This mechanism only reports that a screenshot was taken; it does not provide the captured image itself to the application. Therefore, the application must determine from its own state what content was being displayed at the moment the screenshot was taken. | ||
|
|
||
| `ScreenCaptureCallback` only reports screenshots taken by the user using the device's standard screenshot mechanism (for example, a hardware key combination). It does not report screenshots taken via adb or screenshots generated with other tools that capture the current screen content. Additionally, since the callback operates on a per-activity basis, only screenshots taken while the registered activity is visible can be detected. |
There was a problem hiding this comment.
Restored comment from @wischbgr
Please mention, that AccessibilityService.takeScreenshot() is also not detected. Third party screenshot apps are known to use this method.
Official Android API Reference for Activity.ScreenCaptureCallback: developer.android.com/reference/android/app/Activity.ScreenCaptureCallback
Official Android API Reference for AccessibilityService.takeScreenshot: developer.android.com/reference/android/accessibilityservice/AccessibilityService.TakeScreenshotCallback
Please also reference:
Official Guide on Screenshot Detection: developer.android.com/about/versions/14/features/screenshot-detection
There was a problem hiding this comment.
Thank you for your comments and explanations
|
@simge-yigit before proceeding, there are many instances of bad markdown formatting that we need to ask you to fix first. For example:
For more information see https://mas.owasp.org/contributing/writing-content/markdown.instructions/#in-text-keywords |
|
I tried to update the PR quickly. I’ll revise it again properly. Sorry about that. |
|
In my new PR, I tried to explain the limitations of the detection methods as clearly as possible and include the relevant links correctly. |
This PR closes #3858
Description
Adds a Knowledge page describing the detection mechanisms available on Android for screenshot and screen recording events. Covers the platform-provided callbacks introduced in Android 14 (Activity.ScreenCaptureCallback) and Android 15 (WindowManager.addScreenRecordingCallback), as well as indirect detection approaches via MediaStore/FileObserver and DisplayManager. Each mechanism's scope and limitations are described.
AI Tool Disclosure
Check exactly one option.
If AI tools were used to generate or substantially modify code or text, complete the following.
For first-time contributors using AI tools.
Undisclosed use of AI tools will result in the PR being closed. Large rewrites or bulk changes generated by AI require explicit prior approval from the maintainers. Learn more in "Use of AI tools in contributions".
Contributor Checklist
Relevant documentation.
Contributors are expected to understand basic git and GitHub workflows, including forks, branches, commits, and pull requests. The project does not provide training. Pull requests that do not meet these minimum requirements may be closed without review.