CVE-2020-27059: Google Android Privilege Escalation Flaw

CVE-2020-27059 Overview

CVE-2020-27059 is a tapjacking vulnerability in Android's fingerprint authentication mechanism, specifically within the onAuthenticated method of AuthenticationClient.java. This vulnerability allows a malicious application to overlay a deceptive window during fingerprint authentication requests, tricking users into authenticating malicious actions. The attack leverages improper overlay restrictions during biometric authentication, enabling local privilege escalation without requiring any special execution privileges.

Critical Impact

Attackers can exploit this tapjacking vulnerability to trick users into authenticating malicious operations by overlaying deceptive UI elements during fingerprint authentication, leading to local privilege escalation.

Affected Products

• Google Android 8.0
• Google Android 8.1
• Google Android 9.0
• Google Android 10.0
• Google Android 11.0

Discovery Timeline

• 2021-01-11 - CVE CVE-2020-27059 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-27059

Vulnerability Analysis

This vulnerability is classified under CWE-1021 (Improper Restriction of Rendered UI Layers or Frames), commonly known as a tapjacking or clickjacking attack. The flaw exists in the AuthenticationClient.java file within Android's biometric authentication framework. When the onAuthenticated callback is triggered during fingerprint verification, the system fails to properly restrict overlay windows from being displayed on top of the authentication prompt.

The vulnerability exploits a fundamental design weakness in how Android handles UI layer rendering during sensitive biometric operations. A malicious application installed on the device can draw an overlay that appears transparent or deceptive over the legitimate fingerprint authentication dialog, misleading users into believing they are authenticating a benign action when they are actually authorizing a privileged operation.

Root Cause

The root cause of this vulnerability lies in insufficient overlay protection within the onAuthenticated method of AuthenticationClient.java. Android's biometric authentication framework did not properly implement checks to prevent other applications from drawing overlay windows during the critical fingerprint authentication flow. This allows untrusted applications with the SYSTEM_ALERT_WINDOW permission to place deceptive UI elements over legitimate authentication dialogs.

Attack Vector

The attack requires local access and user interaction. An attacker must first install a malicious application on the target device with overlay permissions. When a legitimate app requests fingerprint authentication, the malicious app can display an overlay that either obscures the true nature of the authentication request or presents a fake interface that misleads the user. Since the user believes they are authenticating a routine action, they provide their fingerprint, which is then used to authorize the attacker's privileged operation.

The attack mechanism works as follows: the malicious application monitors for fingerprint authentication events, then rapidly displays an overlay window that covers the legitimate authentication prompt. The overlay may display fake UI elements or simply appear transparent, making the user unaware that they are authenticating something different from what they expect. Since user interaction (fingerprint touch) is required, this is classified as requiring user interaction for exploitation.

Detection Methods for CVE-2020-27059

Indicators of Compromise

• Applications with SYSTEM_ALERT_WINDOW permission that activate during biometric authentication events
• Unusual overlay activity coinciding with fingerprint authentication requests
• Apps requesting both overlay and biometric-related permissions simultaneously
• Unexpected privilege escalation events following fingerprint authentication

Detection Strategies

• Monitor for applications requesting SYSTEM_ALERT_WINDOW permission, especially those from untrusted sources
• Implement runtime detection for overlay windows appearing during biometric authentication flows
• Review installed applications for suspicious permission combinations involving overlay and sensitive operations
• Deploy mobile threat defense solutions that can identify tapjacking behavior patterns

Monitoring Recommendations

• Enable enhanced logging for biometric authentication events on managed devices
• Monitor for new applications granted overlay permissions on enterprise devices
• Implement application vetting policies that scrutinize apps with overlay capabilities
• Use SentinelOne Mobile Threat Defense to detect and alert on suspicious overlay behavior

How to Mitigate CVE-2020-27059

Immediate Actions Required

• Update affected Android devices to the January 2021 security patch level or later
• Review and revoke overlay permissions from untrusted applications
• Restrict installation of applications from unknown sources on enterprise devices
• Educate users about the risks of granting overlay permissions to applications

Patch Information

Google addressed this vulnerability in the Android Security Bulletin January 2021 (Android ID: A-159249069). The fix implements proper overlay restrictions during fingerprint authentication to prevent malicious applications from displaying deceptive UI elements during biometric operations. Organizations should ensure all Android devices are updated to security patch level 2021-01-01 or later.

Workarounds

• Manually review and disable overlay permissions for non-essential applications via Settings > Apps > Special access > Display over other apps
• Avoid installing applications from untrusted sources that request overlay permissions
• Use enterprise MDM solutions to enforce application whitelisting and permission restrictions
• Consider enabling additional authentication factors beyond fingerprint for sensitive operations

# Check current Android security patch level via ADB
adb shell getprop ro.build.version.security_patch

# List applications with overlay permissions
adb shell cmd appops query-op SYSTEM_ALERT_WINDOW allow