Google has emailed Android app developers and has informed them of plans to remove all apps that misuse the Accessibility service from the Play Store.
The
Android Accessibility service is an Android API designed to help app developers create apps for users with disabilities. The API works by allowing an application programmatic access over actions that in normal circumstances require user physical interaction. For example, the Accessibility Service can mimick taps and swipes on UI elements to navigate users through various screens.
This is a very powerful feature, one that malware authors also noticed and incorporated into their malicious apps. For years, these malicious apps have relied on tricking users into granting them access to the Accessibility service. Once they gained such access, it was game over, as this allowed the malware to install itself as device admin, download and install other malware, and execute various operations in the phone's background.
Accessibility services are currently often found in banking trojans, mobile ransomware strains, click-fraud bots, adware, and about any other malware category. Attacks like
Cloak & Dagger and
Toast Overlay Attack heavily rely on it.
