Android Emulator Security - Demo Website

This website is for CCS'21 Paper - Android on PC: On the Security of End-user Android Emulators.

Notes:

Please try to choose the highest video resolution to watch the following demos, which is much more clear.
We blurred some advertisements and account information shown on the emulators in the following demos for anonymization purpose (e.g., our location).
We used Twitter, Facebook as the victim apps in the demo to make our attack clearer. In reality, they could be any app, especially Google Play Store and games (e.g., through our attack, user's valuable accounts and passwords could be stolen).

In the following demos, we have a malicious app on the emulator without any dangerous or privileged permissions. Once started, we could launch the following 5 types of attacks (see details in the paper).

BS_input_sniff.mp4

Keylogger (Input Sniff or MITM)

Emulator: Bluestacks

In this attack, the attacker tries to steal user input (e.g., account crendentials) silently.

Nox_input_inject.mp4

Input Injection

Emulator: NoxPlayer

Note:

After we start the attack, we do not move the user mouse. Instead, all the operations are done by the malicious app through injecting touch/keyboard events to the emulator.

LD_tab_hijacking.mp4

LD_tab_hijacking_2.mp4

Tab Session Hijacking

Emulator: LDPlayer

In these 2 attacks, we create the phishing activity to cover or replace the legitimate one.

Attack 1: spoof the "focus" status of the tab

Attack 2: spoof the "content" of the tab

MU_install_hijacking.mp4

Installation Hijacking

Emulator: MuMu

In this attack, we hijack the original app installation process to silently install our trojan apk file.

MU_cmd_inject.mp4

Shell/ADB Abusing

Emulator: MuMu

In this attack, we could gain root privilege through injecting commands to the exposed shell or adb daemon of the emulator.

Google Sites

Report abuse