Permissionless Android Universal Overlays by Dimitrios Valsamaras

Overview: Dimitrios Valsamaras, Senior Security Researcher at Microsoft Threat Intelligence and former Google Play Store malware review lead, presents research on universal Android overlay attacks that require no permissions. The presentation analyzes Android's graphics architecture, window management lifecycle, and the historical evolution of UI confusion and tapjacking attacks. Valsamaras demonstrates how systemic design behaviors in window management and backward-compatibility mechanisms allow malicious applications to display deceptive overlays over victim apps without declaring or requesting the sensitive SYSTEM_ALERT_WINDOW permission.

Key Topics: - Android graphics stack architecture (View, Surface, WindowManagerService, SurfaceFlinger, Hardware Composer) - Window Z-ordering, window types, and permission requirements (SDK < 23 backward compatibility) - Window event dispatching flags (FLAG_NOT_TOUCHABLE click-through behavior) - Permissionless universal overlay creation and free-floating process-bound windows

Technical Details: In Android, user interface components (Views) are backed by Surface objects managed by SurfaceFlinger, which coordinates with the Hardware Composer HAL for final on-screen display composition. The ordering, positioning, focus, and lifecycle animations of these surfaces are dictated by the WindowManagerService (WMS). Applications interact with WMS indirectly via WindowManager and WindowManager.LayoutParams. Windows reside along a vertical Z-order axis determined by window types. Historically, high-priority overlay windows (such as TYPE_APPLICATION_OVERLAY or deprecated TYPE_SYSTEM_ALERT) sat atop the Z-axis to display floating elements across the OS, requiring the dangerous SYSTEM_ALERT_WINDOW permission.

The speaker reveals how Android maintains backward compatibility for legacy applications. Prior to Android SDK 23 (Android 6.0 Marshmallow), SYSTEM_ALERT_WINDOW was granted automatically at install time. When modern Android versions run applications targeting SDK versions lower than 23, the platform automatically approves the overlay permission by default. Furthermore, window behavioral flags alter how input events are processed. By applying FLAG_NOT_TOUCHABLE, an overlay window instructs the window manager to ignore user touches and transparently dispatch click events to whatever underlying window sits below, enabling stealthy click-through tapjacking without requiring special user-facing permissions.

Windows added through WindowManager.addView() exhibit process-level persistence rather than activity-level coupling. Once created, these free-floating windows remain active on screen even after the originating application's Activity is dismissed, as long as the parent background process remains alive. Threat actors and Android banking malware exploit this decoupling alongside unprivileged window types to create universal overlays without user notification. By synchronizing overlay instantiation with background task-switching telemetry, a permissionless malware app can project deceptive authentication prompts or disguise malicious consent dialogues over legitimate banking, corporate, or system applications.

Key Takeaways: Android application developers must harden sensitive activities by setting filterTouchesWhenObscured to true to prevent obscured touch dispatching and tapjacking attacks. Operating system vendors must restrict backward compatibility affordances, strictly enforcing runtime permission checks even for apps targeting legacy SDKs below level 23. Mobile threat detection solutions must monitor process-bound floating windows and correlate WindowManager calls with background application states to detect unauthorized UI overlays.

(AI summary — Gemini Flash)