Uploaded image for project: 'Titanium SDK/CLI'
  1. Titanium SDK/CLI
  2. TIMOB-28080

Android: Add "tapjacking" prevention features

    Details

    • Type: New Feature
    • Status: Closed
    • Priority: High
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: Release 9.3.0
    • Component/s: Android
    • Environment:

      Need option to overcome the Tapjacking issue in android and IOS devices

    • Sprint:
      2020 Sprint 17, 2020 Sprint 18, 2020 Sprint 19

      Description

      Summary:
      "Tapjacking" is an Android exploit where a malicious app can display a translucent system overlay on top of other apps with the intent of intercepting touches or to trick the end-user into tapping the overlay app instead of the intended app.

      We need new properties/events to prevent and detect this.

      Solution:

      • Add boolean property "filterTouchesWhenObscured" to all Ti.UI.View derived types. When set true, will prevent all touch/click related events that have passed through another app's overlay window.
      • Add event "touchfiltered" to Ti.UI.Button to be fired if "filterTouchesWhenObscured" is set true and the touch event was filtered due to an overlay. This event is intended to display an alert dialog to the end-user explaining the reason why the action was blocked.
      • Add boolean property "obscured" to all touch/click related events. Will be true if touch event passed through another app's overlay and "filterTouchesWhenObscured" is false. Allows app developer to do manual filtering.

      Note 1:
      The attached AppcOverlay.apk is an Android test app made by us to display a system overlay. We can use this to test the "obscure" touch event handling/filtering.

      Note 2:
      This was requested by customer K. Sakthivel. Please see attached conversation Chat - Motiur.docx with tech-support.

        Attachments

          Activity

            People

            • Assignee:
              jquick Joshua Quick
              Reporter:
              ksakthivel K Sakthivel
              Reviewer:
              Gary Mathews
              Tester:
              Samir Mohammed
            • Watchers:
              8 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Backbone Issue Sync

                • Backbone Issue Sync is enabled for your project, but we do not have any synchronization info for this issue.

                  Git Integration