- I-Pixnapping inokweba iikhowudi ze-2FA kunye nenye idatha yesikrini kwimizuzwana engaphantsi kwe-30 ngaphandle kwemvume.
- Isebenza ngokusebenzisa kakubi i-APIs ye-Android kunye netshaneli ye-GPU esecaleni ukukhupha iipikseli kwezinye ii-apps.
- Ivavanywe kwiPixel 6-9 kunye neGalaxy S25; isiqwenga sokuqala (CVE-2025-48561) asiyivali ngokupheleleyo.
- Kuyacetyiswa ukuba usebenzise iFIDO2/WebAuthn, unciphise idatha ebuthathaka kwiscreen, kwaye unqande usetyenziso olusuka kwimithombo ethandabuzekayo.
Iqela labaphandi liye latyhila Pixnapping, enye Ubuchwephesha bohlaselo ngokuchasene neefowuni ze-Android ezikwaziyo ukubamba oko kuboniswe kwiscreen kunye nokukhupha idatha yabucala njengeekhowudi ze-2FA, imiyalezo okanye iindawo kwimizuzwana kwaye ngaphandle kokucela imvume.
Isitshixo kukusebenzisa kakubi inkqubo ethile ye-APIs kunye a Ijelo elisecaleni le-GPU ukufumanisa umxholo weepikseli ozibonayo; inkqubo ayibonakali kwaye iyasebenza nje ukuba ulwazi luhlala lubonakala, ngelixa Iimfihlo ezingaboniswanga kwiscreen azinakubiwa. UGoogle wazise ukuthomalalisa okunxulumene ne I-CVE-2025-48561, kodwa ababhali bokufumanisa baye babonisa iindlela zokuphepha, kwaye ukuqiniswa ngakumbi kulindeleke kwi-bulletin yokhuseleko lwe-Android kaDisemba.
Yintoni iPixnapping kwaye kutheni iyinkxalabo?
Igama idibanisa "pixel" kunye "nokuxhwila" kuba uhlaselo ngokoqobo lenza a "i-pixel hijacking" ukuvuselela ulwazi oluvela kwezinye ii-apps. Kukuvelela kweendlela zetshaneli ezisecaleni ezazisetyenziswa kwiminyaka eyadlulayo kwizikhangeli, ngoku zilungelelaniswe ne-ecosystem ye-Android yale mihla ngokuphunyezwa okugudileyo, okuthe cwaka.
Kuba ayifuni mvume zikhethekileyo, I-Pixnapping igwema ukukhusela ngokusekelwe kwimodeli yemvume kunye isebenza phantse ngokungabonakali, okwandisa umngcipheko kubasebenzisi kunye neenkampani ezithembele inxalenye yokhuseleko lwazo kwizinto ezibonakala ngokukhawuleza kwisikrini.
Uhlaselo lwenziwa njani
Ngokubanzi, i-app enobungozi i-orchestrates a imisebenzi ehambayo kunye nokulungelelanisa unikezelo ukwahlula iindawo ezithile zojongano apho idatha enovakalelo iboniswa; emva koko usebenzise umahluko wexesha xa kusetyenzwa iipixels ukuxela ixabiso lazo (bona ukuba njani Iiprofayili zamandla zichaphazela i-FPS).
- Ibangela usetyenziso ekujoliswe kulo ukubonisa idatha (umzekelo, ikhowudi ye-2FA okanye isicatshulwa esibucayi).
- Ifihla yonke into ngaphandle kwendawo yomdla kwaye isebenzise isakhelo sonikezelo ukuze ipixel enye "ilawule."
- Itolika amaxesha okusebenza kweGPU (umzekelo. GPU.zip uhlobo lwesenzeko) kwaye wakha ngokutsha umxholo.
Ngokuphindaphinda kunye nongqamaniso, i-malware ifumana abalinganiswa kwaye ibahlanganise kwakhona isebenzisa Iindlela ze-OCRIxesha lefestile linciphisa uhlaselo, kodwa ukuba idatha ihlala ibonakala imizuzwana embalwa, ukubuyisela kunokwenzeka.
Ububanzi kunye nezixhobo ezichaphazelekayo
Izifundiswa zaqinisekisa ubuchwephesha kwi I-Google Pixel 6, 7, 8 kunye ne-9 kunye Samsung Galaxy S25, kunye neenguqulelo ze-Android 13 ukuya kwi-16. Ekubeni i-APIs exhatshaziweyo ifumaneka ngokubanzi, ilumkisa ukuba “phantse zonke ii-Android zale mihla” kunokuba sesichengeni.
Kuvavanyo ngeekhowudi ze-TOTP, uhlaselo lufumene ikhowudi yonke ngeereyithi ezimalunga 73%, 53%, 29% kunye 53% kwi-Pixel 6, 7, 8 kunye ne-9, ngokulandelelanayo, kwaye ngamaxesha aphakathi kufutshane 14,3s; 25,8s; 24,9 kunye 25,3s, ikuvumela ukuba ufike ngaphambi kokuphelelwa kweekhowudi zexeshana.
Yeyiphi idatha enokuwa
Ukongeza kwi Iikhowudi zoqinisekiso (Isiqinisekiso sikaGoogle), abaphandi babonise ukubuyiswa kolwazi kwiinkonzo ezifana Gmail kunye Google akhawunti, imiyalezo apps ezifana Umqondiso, amaqonga zemali ezifana Venmo okanye indawo data evela iimaphu zikagoogle, phakathi kwabanye.
Bakwakulumkisa malunga nedatha ehlala kwiscreen ixesha elide, njenge amabinzana okubuyisela isipaji okanye izitshixo zexesha elinye; nangona kunjalo, izinto ezigciniweyo kodwa ezingabonakaliyo (umzekelo, iqhosha eliyimfihlo alizange liboniswe) lingaphaya kobubanzi bePixnapping.
Impendulo kaGoogle kunye neMeko yePatch
Okufunyenweyo kwabhengezwa kwangaphambili kuGoogle, obhale lo mbandela njengongqongqo obuphezulu kwaye wapapasha unciphiso lokuqala olunxulunyaniswa I-CVE-2025-48561Nangona kunjalo, abaphandi bafumana iindlela zokuyiphepha, ngoko Isiqendu esongezelelweyo sithenjisiwe kwincwadana yeendaba kaDisemba kunye nolungelelwaniso kunye noGoogle kunye ne-Samsung kugcinwa.
Imeko yangoku icebisa ukuba ibhloko eqinisekileyo iya kufuna ukuphononongwa kwendlela i-Android ephatha ngayo unikezelo kunye nokwaleka phakathi kwezicelo, kuba uhlaselo lusebenzisa ngokuchanekileyo ezo ndlela zangaphakathi.
Amanyathelo okunciphisa acetyiswayo
Kubasebenzisi bokugqibela, kuyacetyiswa ukunciphisa ukuvezwa kwedatha enovakalelo kwiscreen kwaye ukhethe ungqinisiso olunganyangekiyo kwi phishing kunye nemijelo esecaleni, efana FIDO2/WebAuthn enezitshixo zokhuseleko, Ukunqanda ukuthembela ngokukodwa kwiikhowudi ze-TOTP nanini na kunokwenzeka.
- Gcina isixhobo sakho sisexesheni kwaye usebenzise iibhulethi zokhuseleko ngokukhawuleza nje ukuba zifumaneke.
- Kuphephe ukufaka usetyenziso olusuka imithombo engangqinisiswanga kunye neemvume zokuphonononga kunye nokuziphatha okungaqhelekanga.
- Musa ukugcina amabinzana okubuyisela okanye iziqinisekiso zibonakala; khetha izipaji zehardware ukugada izitshixo.
- Tshixa isikrini ngokukhawuleza kwaye unqande ujongo lwangaphambili lwesiqulatho esibuthathaka.
Kumaqela emveliso kunye nophuhliso, lixesha lokuba uphononongo lokuhamba koqinisekiso kunye nokunciphisa umphezulu wokuvezwa: nciphisa umbhalo oyimfihlo kwiscreen, ukwazisa ukhuseleko olongezelelweyo kwimibono ebalulekileyo kwaye uvavanye utshintsho iindlela code-free ihardware-based.
Nangona uhlaselo lufuna ukuba ulwazi lubonakale, ukukwazi ukusebenza kwalo ngaphandle kwemvume kwaye ngaphantsi kwesiqingatha somzuzu iyenza ibe sisoyikiso esibi: ubuchule betshaneli esecaleni ethatha ithuba le Amaxesha onikezelo lweGPU ukufunda okubonayo kwiscreen, kunye nonciphiso oluyinxenye namhlanje kunye nokulungiswa okunzulu okulindileyo.
Ndingumntu othanda itekhnoloji ojike umdla wakhe we "geek" waba ngumsebenzi. Ndichithe ngaphezulu kweminyaka eli-10 yobomi bam ndisebenzisa itekhnoloji yokusika kwaye ndikhenkceza ngazo zonke iintlobo zeenkqubo ngenxa yokufuna ukwazi okumsulwa. Ngoku ndiqeqeshelwe ubugcisa bekhompyutha nakwimidlalo yevidiyo. Oku kungenxa yokuba ngaphezu kweminyaka emi-5 ndibhalela iiwebhusayithi ezahlukeneyo kwitekhnoloji kunye nemidlalo yevidiyo, ndisenza amanqaku afuna ukukunika ulwazi oludingayo ngolwimi oluqondakalayo kuye wonke umntu.
Ukuba unayo nayiphi na imibuzo, ulwazi lwam lusuka kuyo yonke into enxulumene nenkqubo yokusebenza yeWindows kunye ne-Android yeefowuni eziphathwayo. Kwaye ukuzinikela kwam kukuwe, ndihlala ndikulungele ukuchitha imizuzu embalwa kwaye ndikuncede usombulule nayiphi na imibuzo onokuba nayo kweli lizwe le-intanethi.