VisualAuth: Secure Transaction Authentication and Trusted UI on COTS Android Devices

Security of critical smartphone applications, including mobile banking, e-commerce and cashless payments, can be jeopardized by kernel-level or UI-targeting malware, for instance by employing clickjacking or overlay attacks. In this work we propose a novel approach to building secure UI screens based on DRM system and demonstrate its feasibility on Android for transaction authentication use case. Security of our solution is based on a TEE thus making it resilient against privileged malware. Additionally, we introduce a detection mechanism for overlay attacks based on random background patterns. Our approach does not require any system customization and is deployable on a wide range of COTS devices. The usability of the proposed solution was validated by means of an online survey, which indicated high detection rate of overlay attacks. Aside of simple transaction authentication, similar to the Android Protected Confirmation (APC) but with a wider device support, our approach can be used to realize more general applications, for instance, secure voting input screen, document viewing, confidential news reading and social media clients, providing high security against spyware or remote forensics investigations.