Strandhogg 2.0 steals data by posing as legitimate Android apps

What you need to know

• Security researchers have found another exploit similar to the original Strandhogg discovered back in December.
• This version is more sophisticated, allowing it to pose as a legitimate app that users are putting their passwords into permission hijacking.
• This exploit does not work with Android 10 and has been patched in the latest Android security fixes.

Looks like Strandhogg is back with an even more evil twin — and this is coming from someone who is an evil twin herself. Strandhogg 2.0, announced today by security researchers, once again tricks users into thinking that they're putting their passwords into a legitimate app when they're actually putting it into malware. The exploit is a more sophisticated version of the original Strandhogg exploit found back in December that made users think they were interacting with a legitimate website instead of a malware layer.

This new version only impacted Android 9.0 and below — Android 10 wasn't susceptible to it — and Google has said that this has been fixed the latest Android security patches for previous Android versions. When I asked out in-house security guru Jerry Hildenbrand about how worried the average user would need to be about it, he summed it up pretty easily:

So, what happened here is the system seeming to work: some security researchers found an exploit, told Google and collected their bug bounty for it, Google patched the bug, and then the security researchers published what they found after most phones were protected by the new patch so that they could show off their work and remind us why security researchers matter.

Thanks, Promon, and nice logo.

• Android Security Bulletin: Everything you need to know!