Uploaded image for project: 'Titanium SDK/CLI'
  1. Titanium SDK/CLI
  2. TIMOB-28080

Android: Add "tapjacking" prevention features


    • Type: New Feature
    • Status: Closed
    • Priority: High
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: Release 9.3.0
    • Component/s: Android
    • Environment:

      Need option to overcome the Tapjacking issue in android and IOS devices

    • Sprint:
      2020 Sprint 17, 2020 Sprint 18, 2020 Sprint 19


      "Tapjacking" is an Android exploit where a malicious app can display a translucent system overlay on top of other apps with the intent of intercepting touches or to trick the end-user into tapping the overlay app instead of the intended app.

      We need new properties/events to prevent and detect this.


      • Add boolean property "filterTouchesWhenObscured" to all Ti.UI.View derived types. When set true, will prevent all touch/click related events that have passed through another app's overlay window.
      • Add event "touchfiltered" to Ti.UI.Button to be fired if "filterTouchesWhenObscured" is set true and the touch event was filtered due to an overlay. This event is intended to display an alert dialog to the end-user explaining the reason why the action was blocked.
      • Add boolean property "obscured" to all touch/click related events. Will be true if touch event passed through another app's overlay and "filterTouchesWhenObscured" is false. Allows app developer to do manual filtering.

      Note 1:
      The attached AppcOverlay.apk is an Android test app made by us to display a system overlay. We can use this to test the "obscure" touch event handling/filtering.

      Note 2:
      This was requested by customer K. Sakthivel. Please see attached conversation Chat - Motiur.docx with tech-support.




            • Assignee:
              jquick Joshua Quick
              ksakthivel K Sakthivel
              Gary Mathews
              Samir Mohammed
            • Watchers:
              8 Start watching this issue


              • Created:

                Backbone Issue Sync

                • Backbone Issue Sync is enabled for your project, but we do not have any synchronization info for this issue.

                  Git Integration