Strandhogg 2.0 steals data by posing as legitimate Android apps

Looks like Strandhogg is back with an even more evil twin — and this is coming from someone who is an evil twin herself. Strandhogg 2.0, announced today by security researchers, once again tricks users into thinking that they're putting their passwords into a legitimate app when they're actually putting it into malware. The exploit is a more sophisticated version of the original Strandhogg exploit found back in December that made users think they were interacting with a legitimate website instead of a malware layer.

This new version only impacted Android 9.0 and below — Android 10 wasn't susceptible to it — and Google has said that this has been fixed the latest Android security patches for previous Android versions. When I asked out in-house security guru Jerry Hildenbrand about how worried the average user would need to be about it, he summed it up pretty easily:

It seems sophisticated, so its not very likely to have ever been found or used "in the wild". It was also patched in last security update, so even Google sees how important it was to close the hole even considering the above.

So, what happened here is the system seeming to work: some security researchers found an exploit, told Google and collected their bug bounty for it, Google patched the bug, and then the security researchers published what they found after most phones were protected by the new patch so that they could show off their work and remind us why security researchers matter.

Thanks, Promon, and nice logo.

• Android Security Bulletin: Everything you need to know!