* [Blog](https://www2.paloaltonetworks.com/blog) * [Palo Alto Networks](https://www2.paloaltonetworks.com/blog/corporate/) * [未分类](https://www2.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant) * 威胁简报：即刻安装补丁程序，以免受到 Androi... # 威胁简报：即刻安装补丁程序，以免受到 Android Toast 覆盖的攻击 [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2017%2F09%2Funit42-threat-brief-patch-today-dont-get-burned-android-toast-overlay-attack%2F%3Flang%3Dzh-hans) [](https://twitter.com/share?text=%E5%A8%81%E8%83%81%E7%AE%80%E6%8A%A5%EF%BC%9A%E5%8D%B3%E5%88%BB%E5%AE%89%E8%A3%85%E8%A1%A5%E4%B8%81%E7%A8%8B%E5%BA%8F%EF%BC%8C%E4%BB%A5%E5%85%8D%E5%8F%97%E5%88%B0+Android+Toast+%E8%A6%86%E7%9B%96%E7%9A%84%E6%94%BB%E5%87%BB&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2017%2F09%2Funit42-threat-brief-patch-today-dont-get-burned-android-toast-overlay-attack%2F%3Flang%3Dzh-hans) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2017%2F09%2Funit42-threat-brief-patch-today-dont-get-burned-android-toast-overlay-attack%2F%3Flang%3Dzh-hans&title=%E5%A8%81%E8%83%81%E7%AE%80%E6%8A%A5%EF%BC%9A%E5%8D%B3%E5%88%BB%E5%AE%89%E8%A3%85%E8%A1%A5%E4%B8%81%E7%A8%8B%E5%BA%8F%EF%BC%8C%E4%BB%A5%E5%85%8D%E5%8F%97%E5%88%B0+Android+Toast+%E8%A6%86%E7%9B%96%E7%9A%84%E6%94%BB%E5%87%BB&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www2.paloaltonetworks.com/blog/2017/09/unit42-threat-brief-patch-today-dont-get-burned-android-toast-overlay-attack/?lang=zh-hans&ts=markdown) \[\](mailto:?subject=威胁简报：即刻安装补丁程序，以免受到 Android Toast 覆盖的攻击) Link copied By [Christopher Budd](https://www.paloaltonetworks.com/blog/author/christopher-budd/?lang=zh-hans&ts=markdown "Posts by Christopher Budd") Sep 07, 2017 1 minutes [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [Android](https://www.paloaltonetworks.com/blog/tag/android-zh-hans/?lang=zh-hans&ts=markdown) [Cloak and Dagger](https://www.paloaltonetworks.com/blog/tag/cloak-and-dagger-zh-hans/?lang=zh-hans&ts=markdown) [Toast 覆盖攻击](https://www.paloaltonetworks.com/blog/tag/toast-%e8%a6%86%e7%9b%96%e6%94%bb%e5%87%bb/?lang=zh-hans&ts=markdown) [勒索软件](https://www.paloaltonetworks.com/blog/tag/%e5%8b%92%e7%b4%a2%e8%bd%af%e4%bb%b6/?lang=zh-hans&ts=markdown) [恶意软件](https://www.paloaltonetworks.com/blog/tag/%e6%81%b6%e6%84%8f%e8%bd%af%e4%bb%b6/?lang=zh-hans&ts=markdown) This post is also available in: [English (英语)](https://www2.paloaltonetworks.com/blog/2017/09/unit42-threat-brief-patch-today-dont-get-burned-android-toast-overlay-attack/ "切换到 英语(English)") [繁體中文 (繁体中文)](https://www2.paloaltonetworks.com/blog/2017/09/unit42-threat-brief-patch-today-dont-get-burned-android-toast-overlay-attack/?lang=zh-hant "切换到 繁体中文(繁體中文)") [Français (法语)](https://www2.paloaltonetworks.com/blog/2017/09/unit42-description-de-la-menace-appliquez-un-correctif-des-aujourdhui-et-ne-vous-brulez-pas-les-doigts-avec-une-superposition-toast-android/?lang=fr "切换到 法语(Français)") [日本語 (日语)](https://www2.paloaltonetworks.com/blog/2017/09/unit42-threat-brief-patch-today-dont-get-burned-android-toast-overlay-attack/?lang=ja "切换到 日语(日本語)") [한국어 (韩语)](https://www2.paloaltonetworks.com/blog/2017/09/unit42-threat-brief-patch-today-dont-get-burned-android-toast-overlay-attack/?lang=ko "切换到 韩语(한국어)") 今天，Palo Alto Networks Unit 42 研究人员发布了关于影响 Google Android 平台的新型高严重性漏洞的[详细信息](https://www.paloaltonetworks.com/blog/2017/09/unit42-android-toast-overlay-attack-cloak-and-dagger-with-no-permissions/)。[2017 年 9 月 Android 安全公告](https://source.android.com/security/bulletin/2017-09-01)中提供了用于修复该漏洞的补丁。这种新型漏洞不会影响最新版本 [Android 8.0 Oreo](https://www.android.com/versions/oreo-8-0/)，但会影响所有之前的 Android 版本。某些恶意软件会通过本文列出的一些途径进行漏洞利用，但 Palo Alto Networks Unit 42 目前并未发现针对这一特定漏洞进行的任何攻击。由于 Android 8.0 版本相对较新，这意味着几乎所有 Android 用户都应立即采取行动，安装针对此漏洞的更新。 我们的研究人员发现利用该漏洞能够更容易发起"覆盖攻击"，这是一种针对 Android 平台的已知攻击类型。此类攻击最有可能用于在用户的 Android 设备上安装恶意软件，还可用于使恶意软件完全控制设备。在最坏的情况下，该漏洞可导致手机无法使用（即"变砖"）或安装任意恶意软件，包括（但不限于）勒索软件或信息窃取程序。简单说来，该漏洞可用于控制、锁定被攻击设备并在之后窃取信息。 在"覆盖攻击"中，攻击者的应用会在设备上运行的其他窗口和应用上绘制（或者说"覆盖"）一个窗口。如果得逞，则攻击者将会诱骗用户，使其将自己点击的入侵窗口当作正常窗口。在图 1 的示例中，攻击者让用户以为自己是在通过单击来安装补丁，但实际上用户单击后会授予 Porn Droid 恶意软件对设备的完全管理员权限。 ![AndroidToast\_7](https://www.paloaltonetworks.com/blog/wp-content/uploads/2017/09/AndroidToast_7.png) 图 1：伪造的补丁安装程序下所覆盖的恶意软件正在请求获取管理权限 您可以看到这种攻击是如何诱骗用户无意中在设备上安装恶意软件的。它还可用于授予恶意软件对设备的完全管理权限。 覆盖攻击也可通过在设备上显示无法关闭的窗口，从而创造拒绝服务条件。这正是攻击者在移动设备上发起勒索软件攻击所使用的方式。 当然，覆盖攻击可在一次攻击中实现以下三个目的： 1. 诱骗用户在设备上安装恶意软件。 2. 诱骗用户授予恶意软件对设备的完全管理权限。 3. 使用覆盖攻击锁定设备并以此索要赎金。 覆盖攻击并不是新生事物，此前就已经引起过人们的关注。但在此之前，根据 [IEEE 安全与隐私期刊](http://iisp.gatech.edu/sites/default/files/documents/ieee_sp17_cloak_and_dagger_final.pdf)中的最新研究结果，所有人都认为试图发起覆盖攻击的恶意应用要想成功，必须克服两大障碍： 1. 必须在安装时明确要求用户授予其"draw on top"权限。 2. 必须通过 Google Play 进行安装。 这些都是重要的缓解因素，正因如此，覆盖攻击并没有被视为严重威胁。 但是，我们新的 Unit 42 研究显示，有一种途径可以绕过这些缓解因素发起覆盖攻击。我们的研究人员发现，如果恶意应用利用这个新漏洞，那么它只需安装在设备上即可发起覆盖攻击。特别是，这意味着来自网站和除 Google Play 之外的其他应用商店的恶意应用均可发起覆盖攻击。值得注意的是，来自网站和除 Google Play 之外的其他应用商店的应用是全球 Android 恶意软件的重要来源。 其中一个特定漏洞可影响名为"[Toast](https://developer.android.com/guide/topics/ui/notifiers/toasts.html)"（吐司）的 Android 功能。"Toast"是一种在屏幕上"弹出"（就像烤吐司一样）的通知窗口。"Toast"通常用于在其他应用之上显示消息和通知。 与 Android 中的其他窗口类型不同，Toast 不需要相同的权限，因此适用于以前的覆盖攻击的缓解因素在此并不适用。此外，我们的研究人员也已概述了如何创建覆盖整个屏幕的 Toast 窗口，因此使用 Toast 创建与常规应用窗口功能相同的窗口是可能的。 根据这项最新研究，覆盖攻击的风险便具有更高的严重性。幸运的是，最新版本的 Android 从一开始即可免受这些攻击的影响。但是，大多数使用旧版本 Android 的用户却容易受到攻击。这意味着对于所有使用 8.0 之前版本的 Android 用户来说，更新设备至关重要。您可以从移动运营商和手机制造商处了解关于补丁和更新可用性的信息。 当然，防范恶意应用最好的途径之一就是仅从 Google Play 安装 Android 应用，因为 Android 安全团队始终积极筛选恶意应用并从一开始就将其排除在商店之外。 *** ** * ** *** ## Related Blogs ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### AI代理已經來臨，威脅也隨之而來](https://www2.paloaltonetworks.com/blog/2025/05/ai-agents-threats/?lang=zh-hant) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### Strata Copilot - 加速迈向自主网络安全的未来](https://www2.paloaltonetworks.com/blog/network-security/strata-copilot/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 防火墙已死？至少本世纪不会！](https://www2.paloaltonetworks.com/blog/2023/08/ngfw-is-not-dead-yet/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 面对性命攸关的时刻，如何实现可靠的医疗物联网安全](https://www2.paloaltonetworks.com/blog/2022/12/medical-iot-security-to-depend-on/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 利用业界首创的 AIOps for NGFW 革新防火墙运行](https://www2.paloaltonetworks.com/blog/2022/03/industry-first-aiops-for-ngfw/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### Prisma Access 是保护远程用户安全的领先云服务](https://www2.paloaltonetworks.com/blog/2021/08/prisma-access-leading-cloud-service-secure-remote-users/?lang=zh-hans) ### Subscribe to the Blog! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www2.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} ## Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) ## Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) ## Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language