Why aren't these UI "hacks" more often exploited?

Question

What I'm talking about:

• Facebook publishes a standalone app called Messenger on the Play Store. It's a chat app, for interactions with other Facebook users. It implements something called "chat heads" which are these round bubbles that sit on top of everything else in the Android UI (except the status bar) that allow for opening an Always On Top chat UI.

• Facebook also publish their namesake app, which implemented intrusive notifications for itself, that appear at the top of the screen and contain their relevant content.

  They render on top of the system status bar preventing access to it when the app isn't active

These are benign examples but they intrude on userland and feel malicious in the way they manifest themselves -- appearing without warning.

Facebook gave its apps hidden ways to disable these things.

What surprises me is that there are not more apps that exploit these UI security "holes".

If I were in the business of infecting people's phones, I would take advantage of this and make the most infuriatingly annoying malware because it's as if one program is given control of the entire interface with no escape.

Imagine the things a malicious bit of code could do if it literally prevented the user from doing anything about it. They can't use the interface, so they can't kill the app, they can't turn off the phone and on many phones you can't remove the battery, etc.

Is there an obvious reason why this sort of thing isn't more exploited? I can't find much about it.

Answer 1

That chat bubble is there because you granted Messenger the permission "draw over other apps". In simple terms, call it overlay. The qualified name of the permission is android.permission.SYSTEM_ALERT_WINDOW.

Allows an app to create windows using the type TYPE_SYSTEM_ALERT, shown on top of all other apps. Very few apps should use this permission; these windows are intended for system-level interaction with the user.

_{(Emphasis mine)}

I don't think chat bubbles of Messenger, in any capacity, are meant for system-level interaction with its user, so you can assume that developers of that app and any such app chose to abuse the system's feature for their own interests.

Furthermore, you definitely are not the first person who thought about exploitation of the overlay feature of Android.

ArsTechnica: New Android ransomware locks out victims by changing lock screen PIN

Dubbed Android/Lockerpin.A, the app ... overlays a bogus patch installation window on top of an activation notice. When targets click on the continue button, they really grant the malicious app elevated rights that allow it to make changes to the Android settings. From there, Lockerpin sets or resets the PIN that unlocks the screen lock, effectively requiring users to perform a factory reset to regain control over the device.

...

Once the continue button is pressed, the app will acquire administrator rights [becomes a Device Administrator]. From there it will change the PIN and periodically continue to overlay a fake window in an attempt to hold on to the elevated privileges. It's the first known Android lock-screen ransomware to set a phone's PIN lock. Because it requires non-paying victims to factory reset their phones, it causes them to lose all of their data.

_{(Emphasis mine)}

Just so you know, Android understands the potential damage overlay can cause to a device, hence, when an overlay is actively drawn on screen and user attempts to sideload an app, the install button simply fails to work. See Why can't I press the Install button when installing applications from unknown sources?

If only Android extends this feature to activation/deactivation of device administrators, that would be very nice of them.

In case, you want to know which other app has the same permission, you can use my answer on Determine which app is drawing on top of other apps?

---

The notifications you mentioned, intrusive they may be, are called Heads-up notifications. Until Android 5.1, users didn't have an official way to get rid of them without losing all notifications from an app.

Android Design: Heads-up Notification

When a high-priority notification arrives ..., it is presented to users for a short period of time with an expanded layout exposing possible actions.

After this period of time, the notification retreats to the notification shade. If a notification's priority is flagged as High, Max, or full-screen, it gets a heads-up notification.

_{(Emphasis mine)}

As you may have guessed, Heads-up notifications are not the default type of notification a system should be displaying to a user and a developer have to explicitly opt for it in the app's code. It's just that some developers opine that the things their app do are of the ultimate priority in the life of the user, let alone the system, so they often choose to show every notification as a Heads-up notification.

That said, heads-up notifications were introduced only in Lollipop while your device runs Android KitKat, so definitely, as Andrew T. put it in comments, it must be Facebook's native code which is both creating and displaying those pseudo-Lollipop notifications at the top and above a window.

The reason you can't interact with system bar when that pseudo-Lollipop notification is active, is most likely the use of blocking overlays to display a view which is perceived as a notification by the user. Aaron's answer has explained it with a good working example app.

I searched web between the range Oct 2013 to Oct 2014 (the developmental age of Android 4.4.x) and came to know that there were apps available in Play Store primarily meant to create those pseudo-Lollipop notifications. One such app is Floatifications and the other one I found was Metro Notifications Free. Both uses the same blocking overlay to create those pseudo-Lollipop notifications.

I'm surprised you didn't find toasts pesky enough.

Answer 2

Facebook does a lot more than just bloat your viewing window. Have you seen all of the permissions it requires?!

The methods Facebook use to add chat bubbles are called Blocking Overlays. They are built-in feature of Android. There's an app called Tasker that well visualizes these features. Tasker is an automation app, but you can also create activities called "Scenes" that you can design UIs on. Tasker allows you to display these scenes as:

• Full Window Activities,
• Blocking Dialogs (with a Dim Background option, which don't allow the user to click behind the window),
• Blocking Overlays (which allow the user to continue using the foreground app, much like chat bubbles),
• and non-blocking Overlays (these cannot be focussed or tapped on, taps go right through the overlay to whatever is underneath it).

Non-blocking overlays sound pointless, but that's how "night-mode" and "brightness limiter" apps are created. It's just a semi-transparent overlay on the screen.

So, it's not a super bad thing that apps can utilize your window space, if not abused, they can provide features. In the case of Facebook Messenger all the neat little features definitely has a cost, of privacy (app permissions).

I hope I helped explain these "UI hacks" a little better, and that they're not always bad.