Android accessibility (accessibility) security-related issues

For those who are unable to use Android smartphones for their eyesight, hearing or other physical reasons, Android offers accessibility features and services to help these users operate devices more simply, including text-to-speech, haptic feedback, gesture manipulation, Trackball and handle operation. Developers can build their own accessibility services, which can enhance usability, such as sound cues, physical feedback, and other optional modes of operation.

With the Android version of the upgrade, Android accessibility features are also more powerful, Android 4.0 version, the System auxiliary service function is relatively single, can only get one-way window element information, such as Get input box user input content. After the Android 4.1 version, the System Assistance service added two-way interaction with the window elements, which can be manipulated through the accessibility service, such as clicking a button.

Because the System Assistant service can get the window element information of your current operation in real time, this may give you the risk of disclosing the privacy information, such as obtaining the input content of the non-password input box. It also provides a security risk by simulating user automation clicks in the application elements through accessibility.

This paper realizes the function of automatic installation, unloading and forcing stop of application through system Auxiliary service.

1, androidmanifest.xml files to configure their own implementation of Myaccessibilityservice services.

<?xml version= "1.0" encoding= "Utf-8"? ><manifest xmlns:android= "http://schemas.android.com/apk/res/        Android "package=" Com.jack.accessibility "android:versioncode=" 1 "android:versionname=" 1.0 "> <uses-sdk android:minsdkversion= "8" android:targetsdkversion= "/> <uses-permission android:name=" android.p Ermission. System_alert_window "/> <uses-permission android:name=" Android.permission.BIND_ACCESSIBILITY_SERVICE "/> & Lt;uses-permission android:name= "Android.permission.WRITE_EXTERNAL_STORAGE"/> <uses-permission android:name = "Android.permission.READ_EXTERNAL_STORAGE"/> <application android:allowbackup= "true" android:i con= "@drawable/ic_launcher" android:label= "@string/app_name" android:theme= "@style/apptheme" > &lt            Activity android:name= "com.jack.accessibility.MainActivity" android:label= "@string/app_name" >     <intent-filter>           <action android:name= "Android.intent.action.MAIN"/> <category android:name= "android.in Tent.category.LAUNCHER "/> </intent-filter> </activity> <service android:label= "@string/acc_service_name" Android:name= ". Myaccessibilityservice "android:permission=" Android.permission.BIND_ACCESSIBILITY_SERVICE "> <intent-filte r> <action android:name= "Android.accessibilityservice.AccessibilityService"/> </int ent-filter> <meta-data android:name= "Android.accessibilityservice" android:resource= "@xml/phone_accessibi Lity "/> </service> </application></manifest>

2, configure the corresponding parameter information in the Res/xml/phone_accessibility.xml.

<?xml version= "1.0" encoding= "Utf-8"? ><accessibility-service android:description= "@string/accessibility_ Service_description "     android:accessibilityeventtypes=" Typeallmask "      android:accessibilityfeedbacktype=" Feedbackgeneric "      android:notificationtimeout=" "      android:accessibilityflags=" "      android: Canretrievewindowcontent= "true"  xmlns:android= "Http://schemas.android.com/apk/res/android"/>

3, mainactivity implementation of installation, unloading, forced stop action initiated.

Package Com.jack.accessibility;import Java.io.file;import Java.io.fileoutputstream;import java.io.IOException; Import Java.io.inputstream;import android.net.uri;import Android.os.bundle;import Android.os.environment;import Android.provider.settings;import Android.view.view;import Android.app.activity;import android.content.Intent; public class Mainactivity extends Activity {@Overrideprotected void onCreate (Bundle savedinstancestate) {super.oncreat E (savedinstancestate); Setcontentview (R.layout.activity_main); This.findviewbyid (R.id.activebutton). Setonclicklistener (New View.onclicklistener () {@Overridepublic void OnClick (View arg0) {//TODO auto-generated method Stubintent killintent = new Intent (settings.action_accessibility_settings); startactivity (killintent);}}); This.findviewbyid (R.id.installbutton). Setonclicklistener (New View.onclicklistener () {@Overridepublic void OnClick ( View arg0) {//TODO auto-generated method Stubmyaccessibilityservice.invoke_type = myaccessibilityservice.type_iNstall_app; String fileName = environment.getexternalstoragedirectory () + "/test.apk"; File Installfile = new file (fileName), if (Installfile.exists ()) {Installfile.delete ();} try {installfile.createnewfile (); FileOutputStream out = new FileOutputStream (installfile), byte[] buffer = new Byte[512];inputstream in = Mainactivity.this . Getassets (). Open ("test.apk"), int count;while ((count= in.read (buffer))!=-1) {out.write (buffer, 0, count);} In.close (); Out.close ();} catch (IOException e) {//TODO auto-generated catch Blocke.printstacktrace ();} Intent Intent = new Intent (Intent.action_view); Intent.setdataandtype (Uri.fromfile (New File), "application/vnd.android.package-archive"); StartActivity (intent);}}); This.findviewbyid (R.id.uninstallbutton). Setonclicklistener (New View.onclicklistener () {@Overridepublic void OnClick (View arg0) {//TODO auto-generated method Stubmyaccessibilityservice.invoke_type = Myaccessibilityservice.type _uninstall_app; Uri Packageuri = Uri.parse ("Package:com.example.test"); Intent uninstallintent = new Intent (Intent.action_delete, Packageuri); StartActivity (uninstallintent); }}); This.findviewbyid (R.id.killappbutton). Setonclicklistener (New View.onclicklistener () {@Overridepublic void OnClick (View arg0) {//TODO auto-generated method Stubmyaccessibilityservice.invoke_type = Myaccessibilityservice.type _kill_app;intent killintent = new Intent (settings.action_application_details_settings); Uri Packageuri = Uri.parse ("Package:com.example.test"); Killintent.setdata (Packageuri); startactivity (killintent);}});}

4, Myaccessibilityservice through the automation click to implement the application installation, uninstall, Force stop function.

Package Com.jack.accessibility;import Java.util.list;import Android.accessibilityservice.AccessibilityService; Import Android.annotation.suppresslint;import Android.util.log;import Android.view.keyevent;import Android.view.accessibility.accessibilityevent;import android.view.accessibility.accessibilitynodeinfo;@ Suppresslint ("Newapi") public class Myaccessibilityservice extends Accessibilityservice {public static int invoke_type = 0;public static final int type_kill_app = 1;public static final int type_install_app = 2;public static final int type_unin Stall_app = 3;public static void Reset () {invoke_type = 0;} @Overridepublic void Onaccessibilityevent (Accessibilityevent event) {//TODO auto-generated method Stubthis.processaccessibilityenvent (event);} private void Processaccessibilityenvent (Accessibilityevent event) {log.d ("test", event.eventtypetostring (  Event.geteventtype ())), if (event.getsource () = = null) {LOG.D ("test", "the Source = null"),} else {log.d ("test", "event =" + event.tostring (), switch (invoke_type) {case type_kill_app:processkillapplication (event); Break;case Type_install_app: Processinstallapplication (event); Break;case type_uninstall_app:processuninstallapplication (event); Break;default : Break;}}} @Overrideprotected boolean onkeyevent (KeyEvent event) {//TODO auto-generated method Stubreturn true;} @Overridepublic void Oninterrupt () {//TODO auto-generated method stub}private void Processuninstallapplication ( Accessibilityevent event) {if (Event.getsource () = null) {if (Event.getpackagename (). Equals (" Com.android.packageinstaller ")) {list<accessibilitynodeinfo> ok_nodes = Event.getsource (). Findaccessibilitynodeinfosbytext ("OK"); if (Ok_nodes!=null &&!ok_nodes.isempty ()) {Accessibilitynodeinfo node;for (int i=0; i<ok_nodes.size (); i++) {node = Ok_nodes.get (i); if (Node.getclassname (). Equals (" Android.widget.Button ") && node.isenabled ()) {node.performaction (Accessibilitynodeinfo.action_click);}}}}} private void Processinstallapplication (AccessIbilityevent event) {if (Event.getsource () = null) {if (Event.getpackagename (). Equals ("Com.android.packageinstaller" )) {list<accessibilitynodeinfo> unintall_nodes = Event.getsource (). Findaccessibilitynodeinfosbytext ("Installation"); if (Unintall_nodes!=null &&!unintall_nodes.isempty ()) {accessibilitynodeinfo node;for (int i=0; i<unintall_nodes.size (); i++) {node = Unintall_nodes.get (i); if ( Node.getclassname (). Equals ("Android.widget.Button") && node.isenabled ()) {node.performaction ( Accessibilitynodeinfo.action_click);}}} list<accessibilitynodeinfo> next_nodes = Event.getsource (). Findaccessibilitynodeinfosbytext ("Next"); if (next_ Nodes!=null &&!next_nodes.isempty ()) {accessibilitynodeinfo node;for (int i=0; i<next_nodes.size (); i++) { node = Next_nodes.get (i), if (Node.getclassname (). Equals ("Android.widget.Button") && node.isenabled ()) { Node.performaction (Accessibilitynodeinfo.action_click);}}} list<accessibilitynodeinfo> ok_nodes = Event.getsource (). Findaccessibilitynodeinfosbytext ("open"); if (Ok_nodes!=null &&!ok_nodes.isempty ()) {Accessibilitynodeinfo node;for (int i=0; i<ok_nodes.size (); i++) {node = Ok_nodes.get (i); if (Node.getclassname (). Equals (" Android.widget.Button ") && node.isenabled ()) {node.performaction (Accessibilitynodeinfo.action_click);}}}}} private void Processkillapplication (Accessibilityevent event) {if (Event.getsource ()! = null) {if (event.getpackagename (). Equals ("Com.android.settings")) {list<accessibilitynodeinfo> stop_nodes = Event.getsource (). Findaccessibilitynodeinfosbytext ("Force Stop"); if (Stop_nodes!=null &&!stop_nodes.isempty ()) { Accessibilitynodeinfo node;for (int i=0; i<stop_nodes.size (); i++) {node = Stop_nodes.get (i); if (Node.getclassname () . Equals ("Android.widget.Button")) {if (node.isenabled ()) {node.performaction (Accessibilitynodeinfo.action_click);}}}} list<accessibilitynodeinfo> ok_nodes = Event.getsource (). Findaccessibilitynodeinfosbytext ("OK"); if (ok_nodes !=nulL &&!ok_nodes.isempty ()) {accessibilitynodeinfo node;for (int i=0; i<ok_nodes.size (); i++) {node = Ok_ Nodes.get (i), if (Node.getclassname (). Equals ("Android.widget.Button")) {node.performaction ( Accessibilitynodeinfo.action_click); LOG.D ("Action", "click OK");}}}}}

Full demo:http://download.csdn.net/detail/jiazhijun/8251277

Android accessibility (accessibility) security-related issues