Considering mobile users often use the clipboard to copy and paste sensitive information, like passwords or payment information, clipboard contents can be an attractive target for cyberattacks. Leveraging clipboards can enable attackers to collect target information and exfiltrate useful data. Examples even exist of attackers hijacking and replacing the clipboard contents for malicious purposes, such as modifying a copied cryptocurrency wallet address before the user pastes it into a crypto wallet app or chat message. Moreover, these types of attacks misuse a legitimate system feature rather than exploit a vulnerability, making the issue more challenging to mitigate.
Microsoft discovered that an old version of the SHEIN Android application periodically read the contents of the Android device clipboard and, if a particular pattern was present, sent the contents of the clipboard to a remote server. While we are not specifically aware of any malicious intent behind the behavior, we assessed that this behavior was not necessary for users to perform their tasks on the app.
SHEIN’s Android application is published on the Google Play Store with over 100 million downloads. Even if SHEIN’s clipboard behavior involved no malicious intent, this example case highlights the risks that installed applications can pose, including those that are highly popular and obtained from the platform’s official app store. We reported our findings to Google, the Play Store operator, leading to an investigation by their Android Security Team. In May 2022, Google informed us and we confirmed that SHEIN removed the behavior from the application. We would like to thank Google’s Android Security Team as well as the SHEIN team for their efforts and collaboration in addressing this issue. We would also like to thank the Google team for the improvements implemented to the Android platform to protect users from the risks associated with anomalous clipboard access.
In this blog, we detail how we identified the SHEIN app’s clipboard behavior and how Android users can protect themselves against clipboard-based attacks. We also share this research with the larger security community to emphasize the importance of collaboration in the effort to improve security for all.
The following analysis details how we identified and verified the presence of the SHEIN app’s clipboard behavior, analyzing SHEIN app version 7.9.2 (SHA-256: ff07dc6e237acd19cb33e35c60cb2ae52c460aac76bc27116d8de76abec66c51). We first performed a static analysis of the app to identify the relevant code responsible for the behavior. We then performed a dynamic analysis by running the app in an instrumented environment to observe the code, including how it read the clipboard and sent its contents to a remote server.
Upon opening the application, the launcher activity com.shein.user_service.welcome.WelcomeActivity extends the com.zzkko.base.ui.BaseActivity class, which performs a call to the iBaseActivityCallBack.h method in the onResume callback, depicted below on Line 11:
The com.zzkko.app.iBaseActivityCallBackis aninterfaceimplemented by the com.zzkko.app.BaseActivityCallBack. The method h, partially depicted below, from the previous call performs a call to the method o in the same class, as shown on Line 16:
Finally, in thecom.zzkko.app.BaseActivityCallBack.o method there is a call to the com.zzkko.util.MarketClipboardPhaseLinker.f method, shown on Line 2:
Method com.zzkko.app.BaseActivityCallBack.f, depicted below, checks whether the character sequences “$” and “://” are present in the clipboard text, depicted on Line 6. If both are present, method k in the same class is called with the clipboard text provided as a parameter, as shown on Line 8:
Method com.zzkko.app.BaseActivityCallBack.kinitiates a flow that performs a POST request to the server at BaseUrlConstant.APP_URL + “/marketing/tinyurl/phrase”, which resolves to https://api-service[.]shein[.]com/marketing/tinyurl/phrase:
Since all of the application’s activities (user interfaces) extend com.zzkko.base.ui.BaseActivity, the call chain described above was triggered any time the user launched a new activity, such as by starting or resuming the application or performing certain actions within the app.
To verify our static analysis findings, we performed a dynamic analysis of the application, which we installed from the Google Play Store onto a Samsung device running Android 9.
We used Frida to intercept calls to the android.content.ClipboardManager.getText and com.zzkko.util.MarketClipboardPhaseLinker.f methods to analyze the application’s clipboard behavior. We also used Frida to bypass the application’s certificate pinning to enable us to analyze network traffic using Burp Proxy.
We set the contents of the device clipboard to https://mybank[.]com/token=secretToken&transaction=100$ and opened the application.
Upon opening the application, the following calls were logged:
In Figure 7 above, we observe the following:
Finally, a POST request to api-service[.]shein[.]com is performed. Subsequently, we captured the following request in Burp Proxy, showing the transmission of the clipboard contents to the remote server:
As displayed in this case involving SHEIN, Android applications can call the android.text.ClipboardManager API to read from or write to the device clipboard without requesting the user’s approval or requiring any specific Android permission. While calling the ClipboardManager API can allow apps to make processes easier for users, such as quickly selecting text to copy, applications often should not need to do this since copying and pasting is typically performed by the device input method editor (keyboard), which is a separate application.
To address our research findings and the broader issue at hand, Google has recognized the risks associated with clipboard access and has made the following improvements to the Android platform to protect users:
On Android 10 and above, an application cannot access the clipboard unless it currently has focus (is actively running on the device display) or is set as the default input method editor (keyboard). This restriction guards against background applications accessing the clipboard, but it would not have prevented the behavior described here because the SHEIN application was running in the foreground.
On Android 12 and above, a toast message notifies the user when an application calls the ClipboardManager to access clipboard data from another application for the first time.
Android 13 clears the contents of the clipboard after a period of time to provide an additional degree of protection.
Users can protect themselves by watching out for the clipboard access message. If the message unexpectedly shows, they should assume that any data on the clipboard has been potentially compromised, and they should consider removing any applications that make suspicious clipboard accesses.
Although we’re not aware of any malicious intent by SHEIN, even seemingly benign behaviors in applications can be exploited with malicious intent. Threats targeting clipboards can put any copied and pasted information at risk of being stolen or modified by attackers, such as passwords, financial details, personal data, cryptocurrency wallet addresses, and other sensitive information.
We recommend users further follow the security guidelines below to defend against this and similar risks:
After discovering the SHEIN Android application clipboard behavior, we worked with Google’s Android Security Team to ensure the removal of this behavior from the app. We thank both the Google and SHEIN teams for their efforts and collaboration in addressing the issue.
At Microsoft, we value, protect, and defend privacy—and this case demonstrates our efforts to investigate and protect customers’ privacy beyond security threats. As the threat landscape continues to evolve, Microsoft strives to continuously improve security for all through research-driven protection and collaboration with customers, partners, and industry experts, regardless of the device or platform in use.
We will continue to work with the security community to share research and intelligence about risks and threats in the effort to build better protection for all.
Dimitrios Valsamaras, Michael Peck Microsoft 365 Defender Research Team
Microsoft researchers found multiple vulnerabilities in OpenVPN that could lead to an attack chain allowing remote code execution and local privilege escalation. This attack chain could enable attackers to gain full control over targeted endpoints, potentially resulting in data breaches, system compromise, and unauthorized access to sensitive information.
Microsoft discovered a vulnerability pattern in multiple popular Android applications that could enable a malicious application to overwrite files in the vulnerable application’s internal data storage directory, which could lead to arbitrary code execution and token theft, among other impacts. We have shared our findings with Google’s Android Application Security Research team, as well as the developers of apps found vulnerable to this issue. We anticipate that the vulnerability pattern could be found in other applications. We’re sharing this research more broadly so developers and publishers can check their apps for similar issues, fix as appropriate, and prevent them from being introduced into new apps or releases.
Microsoft has observed ongoing activity from mobile banking trojan campaigns targeting users in India with social media messages and malicious applications designed to impersonate legitimate organizations and steal users’ information for financial fraud scams.
A fake mobile banking rewards app delivered through a link in an SMS campaign has been making the rounds, targeting customers of Indian banking institutions. Users who install the mobile app are unknowingly installing an Android malware with remote access trojan (RAT) capabilities.
