Android App Security · Permissions in Depth · Lesson 3 of 5

Accessibility Services

Why the most helpful kind of access is also malware's favorite.

Full control of the screen

An accessibility service is an app that helps people use their phone in a different way. TalkBack, Android's screen reader, speaks what's on screen for people who are blind or have low vision. Switch Access and Voice Access let people control the phone with switches or by speaking.

To do that job, an accessibility service needs remarkable power. Once you turn one on, it can:

• Get told about what happens on screen, such as which app opened, which button was tapped and when text changed.
• Read the content of the screen, meaning the text and labels of buttons, menus, messages and text fields.
• Act on your behalf by tapping buttons, scrolling, typing, pressing Back or Home, and performing gestures.

In other words, it can see what you see and touch what you can touch, across every app. That's exactly what a screen reader needs, and exactly what a thief would want.

Android knows this, so turning one on isn't a simple prompt. You have to go into Settings > Accessibility, choose the service, and flip its switch. Android then shows a warning that it will have full control of your device, and that full control suits apps that help with accessibility needs, not most apps. The warning lists what the service can do, like viewing and controlling the screen and viewing and performing actions.

On the simulated phone, a downloaded app called Battery Booster Pro wants to be turned on as an accessibility service. Turn it on, read Android's warning, then open the bank login and watch what the service reports.

Why malware wants it, and how Android pushes back

Security researchers have documented many families of Android banking trojans, malware disguised as a normal app that's built to steal money, such as FluBot and Vultur. A common trick is to get the victim to turn on the trojan's accessibility service. With it, the malware can read what's typed into banking apps, watch for one-time codes, tap Allow on its own permission prompts, and press Back whenever you try to open the screen that would remove it.

The bait is usually a reason that sounds harmless. "Enable this to boost your battery." "Turn this on to track your parcel." Remember the warning from the last lesson. A battery booster, a parcel tracker or a flashlight doesn't help you with an accessibility need.

Android 13 added a protection called restricted settings. If an app was installed from a file you downloaded, for example through a browser or a file manager instead of an app store, Android blocks you from turning on its accessibility service or notification access at first. You see a message along the lines of "For your security, this setting is currently unavailable." It can be overridden. You open the app's App info page, tap the three-dot menu, and choose Allow restricted settings. Newer Android versions have reportedly extended it to more kinds of special access. Researchers have seen malware work around the protection, so treat it as a speed bump, not a wall.

That gives you a clear red flag. If a message, a caller or an app walks you through allowing restricted settings, stop. To check what's switched on, open Settings > Accessibility and look at the list of downloaded or installed services. Most people should see none, or only ones they chose.