TapTrap: Animation-Driven Tapjacking on Android

avaluedcustomer

GrapheneOSuser74 As stated on that website, disabling animations will prevent the attack.

yore

Just to make things clear for anyone concerned: while disabling animations does work around TapTrap, it is known to introduce bugs in the past. Therefore it's probably best to leave it on and install the patched release as it rolls out through the release channels.

Additionally, they say on their page:

We analyzed nearly 100,000 Play Store apps and found no signs of TapTrap being used in the wild.

So I wouldn't be too concerned at this time especially with the GrapheneOS patch (thank you!).

Skorp

dc32f0cfe84def651e0e @avaluedcustomer

Just be aware that disabling animations can lead to other issues and vulnerabilities and is generally not recommended.

For example, there was a potential lockscreen bypass vulnerability found at the time GOS introduced the Biometric 2FA PIN, which was caused by having altered the system animation speed. This was fixed but is a warning about messing with developer options in general. Those should be left alone and turned off unless you are using the device for actual development purposes.

avaluedcustomer

Skorp The recommendation is to use the option in the "Accessibility" section. It's not a developer option.

Skorp

Even that could pose issues. The issue that was found was a race-condition (iirc).

avaluedcustomer

Skorp Well, that implies one should not change any system setting.

DeletedUser370

Skorp Even that could pose issues. The issue that was found was a race-condition (iirc).

I am not sure I understand this recommendation. Are there currently known issues caused by disabling animations from the Accessibility menu? Or is the code for that known to be poorly written, not well tested, or the like?

de0u

DeletedUser370 Obviously I don't speak for Google, but it seems as if quite a few options may not be tested through use on daily-driver devices of Google Android developers. For example, I think issues with three-button navigation have been increasing over time (I eventually gave up on it).

Skorp

DeletedUser370

No, just as a defense against unknown vulnerabilities caused by upstream bugs. Accessibility is better than changing in Developer Options but still might be better to leave as is.

See release notes for 2025011500

add protection against upstream lockscreen bugs bypassing restrictions on biometric unlocking while the device is asleep including the standard restrictions and our recently added 2-factor fingerprint unlock feature

I can't find the exact mention from the project but it was related to changes in animation speed and only applied to devices where the animation speed had been changed.

guser39

other8026 Anyway, it's a known bug and not related to TapTrap,

I did not say it was related to TapTrap. I said it appeared to be a consequence of disabling animations, which is one of the "mitigations" to TapTrap. Others in this thread were discussing the potential pitfalls and risks of disabling animations, so I don't see how my response with an example consequence was off-topic.

I should have quoted this question in my original post but this is what I was responding to:

DeletedUser370 Are there currently known issues caused by disabling animations from the Accessibility menu?

other8026 Maybe using "natural" all the time will be less buggy in this case?

I'll keep that in mind. I'm currently set to saturated. I don't plan on disabling animations anytime soon, though.

yore Back in January, I opened a thread about this very issue here.

I did not know disabling animations was known problem so I appreciate pointing me at that thread and some potential solutions. I'll review the thread but I don't think I'll need any further assistance.

Thank you, @yore and @other8026. Hopefully this is my last contribution to this thread.

guser39

I noticed that if you enable "remove animations", this breaks night light. You can turn on night light but you cannot turn it off. The toggles work but the night light never goes away.

If you have night light on a schedule and the current time is outside the night light time window (e.g., it is daytime and night light is only on at night) then a reboot clears the night light.

Accessibility > Color and motion > Remove animations

This impacts both Android 15 and now Android 16.

other8026

guser39 There are multiple upstream bugs like that. You can change the color settings in Settings > Display > Colors to some other value and switch back. That fixes the issue for other people.

Maybe using "natural" all the time will be less buggy in this case? Like these release notes say:

switch default display color mode to Natural for fresh installs for more accurate image/video colors and to avoid bugs tied to the other options

~~Anyway, it's a known bug and not related to TapTrap, so I'd suggest starting a new thread if you want to talk about the bug further.~~

Edit: My mistake thinking they were asking for help with an issue. Their post was on topic. Mine arguably wasn't. Crossed out the incorrect part where I said the post was off topic. Apologies, guser39.

yore

guser39 Back in January, I opened a thread about this very issue here.

Here is what a moderator replied with:

Carlos-Anso Best to avoid disabling animations. Its not well tested in AOSP and causes various bugs. Is the cause of a security issue we fixed in the last release and is potential it could cause others.

Changing speed of animations in Developer options has similar implications.

Hence why I said above it's best to leave animations at its default settings.

other8026

guser39 so I don't see how my response with an example consequence was off-topic.

You're right. I see now that you were going with the flow of the discussion. Sorry for that.

« Previous Page