Preventing user interaction hijacking attacks by blocking interactions with obscured components
A method includes detecting a user interaction with a particular region of a graphical user interface (GUI), and determining that the user interaction will be consumed by a particular user interface (UI) component that is overlaid by a plurality of UI components configured to allow the user interaction to pass through to the particular UI component. The method also includes, based on determining that the user interaction will be consumed by the particular UI component, determining a cumulative opacity of the plurality of UI components at the particular region of the GUI. The method further includes determining that the cumulative opacity exceeds a threshold opacity and, based on determining that the cumulative opacity exceeds the threshold opacity, blocking the particular UI component from consuming the user interaction.
1 . A computer-implemented method comprising:
detecting a user interaction with a particular region of a graphical user interface (GUI);
determining that the user interaction will be consumed by a particular user interface (UI) component that is overlaid by a plurality of UI components, wherein each respective UI component of the plurality of UI components is (i) configured to allow the user interaction to pass through to the particular UI component and (ii) associated with a corresponding opacity for the particular region of the GUI;
based on determining that the user interaction will be consumed by the particular UI component, determining a cumulative opacity of the plurality of UI components at the particular region of the GUI based on the corresponding opacity of each respective UI component of the plurality of UI components;
determining that the cumulative opacity exceeds a threshold opacity; and
based on determining that the cumulative opacity exceeds the threshold opacity, blocking the particular UI component from consuming the user interaction.
2 . The computer-implemented method of claim 1 , wherein the cumulative opacity of the plurality of UI components at the particular region of the GUI differs from the corresponding opacity of each respective UI component.
3 . The computer-implemented method of claim 1 , wherein the corresponding opacity of the respective UI component indicates a maximum opacity of contents of the respective UI component in the particular region of the GUI.
4 . The computer-implemented method of claim 1 , wherein:
the plurality of UI components comprises (i) a first plurality of UI components generated by a first software application and (ii) a second plurality of UI components generated by a second software application,
determining the cumulative opacity of the plurality of UI components comprises (i) determining a first application-specific cumulative opacity of the first plurality of UI components at the particular region of the GUI and (ii) determining a second application-specific cumulative opacity of the second plurality of UI components at the particular region of the GUI, and
determining that the cumulative opacity exceeds the threshold opacity comprises determining that at least one of the first application-specific cumulative opacity or the second application-specific cumulative opacity exceeds the threshold opacity.
5 . The computer-implemented method of claim 4 , wherein the particular UI component is generated by a third software application different from the first software application and the second software application.
6 . The computer-implemented method of claim 1 , wherein:
the plurality of UI components comprises (i) a first plurality of UI components generated by a first software application and (ii) a second plurality of UI components generated by a second software application,
determining the cumulative opacity of the plurality of UI components comprises determining an application-agnostic cumulative opacity, at the particular region of the GUI, of the first plurality of UI components and the second plurality of UI components, and
determining that the cumulative opacity exceeds the threshold opacity comprises determining that the application-agnostic cumulative opacity exceeds the threshold opacity.
7 . The computer-implemented method of claim 1 , wherein the corresponding opacity ranges from a value of zero to a predetermined value, wherein the value of zero represents a minimum opacity and the predetermined value represents a maximum opacity, and wherein determining the cumulative opacity comprises:
determining, for each respective UI component, a corresponding transparency based on a difference between (i) the predetermined value and (ii) the corresponding opacity of the respective UI component;
determining a product of the corresponding transparencies of the plurality of UI components; and
determining the cumulative opacity based on the product.
8 . The computer-implemented method of claim 7 , wherein determining the cumulative opacity based on the product comprises:
determining a difference between (i) the predetermined value and (ii) the product; and
determining the cumulative opacity based on the difference.
9 . The computer-implemented method of claim 1 , wherein the corresponding opacity is represented as a corresponding transparency ranging from a value of zero to a predetermined value, wherein the value of zero represents a minimum transparency and the predetermined value represents a maximum transparency, and wherein determining the cumulative opacity comprises:
determining a product of the corresponding transparencies of the plurality of UI components; and
determining the cumulative opacity based on the product.
10 . The computer-implemented method of claim 1 , wherein the cumulative opacity is represented as a cumulative transparency, wherein the threshold opacity is represented as a threshold transparency, and wherein determining that the cumulative opacity exceeds the threshold opacity comprises:
determining that the cumulative transparency is less than the threshold transparency.
11 . The computer-implemented method of claim 1 , wherein determining that the user interaction will be consumed by the particular UI component comprises:
determining that each respective UI component of the plurality of UI components is associated with an attribute indicating that the respective UI component is configured to ignore the user interaction and allow the user interaction to pass through to a layer of the GUI underlying the respective UI component.
12 . The computer-implemented method of claim 1 , wherein the user interaction comprises touching the particular region of the GUI by way of a touch interface of a mobile computing device.
13 . The computer-implemented method of claim 1 , wherein (i) the detecting of the user interaction, (ii) the determining that the user interaction will be consumed by the particular UI component, (iii) the determining of the cumulative opacity, (iv) the determining that the cumulative opacity exceeds the threshold opacity, and (iv) the blocking of the particular UI component from consuming the user interaction are each performed by an operating system of a computing device independently of software applications executing on the computing device.
14 . The computer-implemented method of claim 1 , wherein the GUI is provided by an operating system of a mobile computing device, and wherein the particular UI component and the plurality of UI components are each generated by the operating system of the mobile computing device in response to a respective request from a corresponding software application executed by the mobile computing device.
15 . The computer-implemented method of claim 1 , further comprising:
determining, for each respective UI component of the plurality of UI components, that a type of the respective UI component is one of a predetermined number of types of UI components;
determining, for each respective UI component, that the respective UI component is untrusted based on determining that the type of the respective UI component is one of the predetermined number of types of UI components; and
determining the cumulative opacity of the plurality of UI components further based on determining that each respective UI component is untrusted.
16 . The computer-implemented method of claim 1 , wherein the GUI comprises a horizontal area and a plurality of vertically-stacked layers, wherein the particular region of the GUI comprises a subset of the horizontal area, and wherein each respective UI component of the plurality of UI components is disposed in a corresponding layer of the plurality of vertically-stacked layers.
17 . The computer-implemented method of claim 1 , wherein the GUI is configured to display each respective UI component of the plurality of UI components in a fixed region of the GUI such that the respective UI component is not repositionable by way of user interactions.
18 . A system comprising:
a processor; and
a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations comprising:
detecting a user interaction with a particular region of a graphical user interface (GUI);
determining that the user interaction will be consumed by a particular user interface (UI) component that is overlaid by a plurality of UI components, wherein each respective UI component of the plurality of UI components is (i) configured to allow the user interaction to pass through to the particular UI component and (ii) associated with a corresponding opacity for the particular region of the GUI;
based on determining that the user interaction will be consumed by the particular UI component, determining a cumulative opacity of the plurality of UI components at the particular region of the GUI based on the corresponding opacity of each respective UI component of the plurality of UI components;
determining that the cumulative opacity exceeds a threshold opacity; and
based on determining that the cumulative opacity exceeds the threshold opacity, blocking the particular UI component from consuming the user interaction.
19 . The system of claim 18 , wherein:
the plurality of UI components comprises (i) a first plurality of UI components generated by a first software application and (ii) a second plurality of UI components generated by a second software application,
determining the cumulative opacity of the plurality of UI components comprises (i) determining a first application-specific cumulative opacity of the first plurality of UI components at the particular region of the GUI and (ii) determining a second application-specific cumulative opacity of the second plurality of UI components at the particular region of the GUI, and
determining that the cumulative opacity exceeds the threshold opacity comprises determining that at least one of the first application-specific cumulative opacity or the second application-specific cumulative opacity exceeds the threshold opacity.
20 . An article of manufacture including a non-transitory computer-readable medium having stored thereon instructions that, when executed by a computing device, cause the computing device to perform operations comprising:
detecting a user interaction with a particular region of a graphical user interface (GUI);
determining that the user interaction will be consumed by a particular user interface (UI) component that is overlaid by a plurality of UI components, wherein each respective UI component of the plurality of UI components is (i) configured to allow the user interaction to pass through to the particular UI component and (ii) associated with a corresponding opacity for the particular region of the GUI;
based on determining that the user interaction will be consumed by the particular UI component, determining a cumulative opacity of the plurality of UI components at the particular region of the GUI based on the corresponding opacity of each respective UI component of the plurality of UI components;
determining that the cumulative opacity exceeds a threshold opacity; and
based on determining that the cumulative opacity exceeds the threshold opacity, blocking the particular UI component from consuming the user interaction.