Some developers have reported that Google Play Store is sending out emails to developers to inform them that their apps will be removed from the Play Store if the apps are using the accessibility services without following the guidelines provided by Google. Now, before you skip this article thinking that this development doesn’t concern you as a user, let me tell you that it certainly does. For understanding how this affects you as a user, you need to understand what accessibility services are in the world of Android.
Well, in layman’s terms, accessibility services are those tools which are included in Android by Google to make apps more accessible to users with disabilities. However, a great number of apps use the accessibility services to perform actions which make the apps better for normal users and not necessarily for users with disabilities. For example, before Android Oreo introduced autofill in apps, popular password manager services used the accessibility settings to scan a web-page for username and password fields to give users the option for auto-filling the details saved in their vaults. Another example is the app Tasker which uses accessibility services to bring automation to your Android device.
However, although most of the apps are using accessibility services to provide extra features to users, the same accessibility services can also be easily exploited by apps to introduce malware, or steal private information from your device. Recently, one such malware known as the Toast Overlay was discovered which when grated access to accessibility services infected the user’s device to introduce ad-clicking, app-installing, and self-protecting/persistence capabilities.
Some apps are even found to use an exploit called Cloak and Dagger which can easily steal your login information. The malware, when granted the accessibility permission, can easily create an overlay over the login fields. So, basically, when you think that you are entering the password inside an app’s login field, you are actually entering the password in an overlay field created by the malware and your password gets stolen. You can see the attack in the video above which shows how truly terrifying it is.
To stop the above-mentioned malware-infections and phishing attacks from happening on Android, Google has decided to remove apps using accessibility services without following the guidelines provided by Google. How genuine services like LastPass and Tasker which use the accessibility services for bringing extra features will counter this change is yet to be seen. But this step is sure to cause some pain to both developers and users alike.
