2026.09.02 14:20 ~ 15:00 Panda

"When you use accessibility, accessibility is also using you" - Malware attacks and defense

Security / Identity / Privacy 日本語 Interpretation available

In Android app development, AccessibilityService (hereinafter a11y) is recognized as a "feature for supporting people with disabilities" and is an area that many developers rarely touch. However, since 2020, banking Trojans have continued to abuse this a11y as the core of their attacks. This talk consists of the following four main parts: Part 1: The role of a11y as a legitimate feature First, I will explain "why a11y is designed with such powerful permissions" from the perspective of supporting people with disabilities. Part 2: How it is abused I will systematize the tactics of real-world banking Trojans through the attack kill chain (distribution → permission acquisition → execution → evasion). In addition, I will show a demo video of a PoC app I created. Part 3: How to defend I will share defensive measures that allow you to check whether your product might be exploited by malware starting the very next day. This will be particularly useful information for those developing products that handle personal information, such as login credentials. Part 4: Ethical trade-offs Completely disabling a11y means excluding users with disabilities from the app. A naive implementation like "stop all features upon detection" leads to discrimination against users who truly need it. Based on this, I will talk about how to make trade-offs between usability and risk mitigation. What you can learn in this talk - Actual kill chain of modern Android banking Trojans - Structure of the AccessibilityService API and examples of how it is abused - Bypass techniques for Restricted Settings (API 33+) using psychology - How to reflect the trade-off between security and accessibility in design Supplementary information The PoC code used in this talk will be made available on GitHub after the presentation. By clearly stating the context of educational and research purposes and intentionally omitting features like C2 communication mechanisms and obfuscation, we maintain a high barrier to abuse. By providing attack and defense methods as a set, we ensure its social value as security research. (Translated by the DroidKaigi Committee)

Intended audience

・ Developers involved in product development where security is critical ・ Developers who want to raise security awareness ・ Developers who implement AccessibilityService ・ People who want to learn from an attacker's perspective for educational purposes

Sessions in the same time slot

View all sessions