Adversaries may abuse Clipboard Manager APIs to obtain sensitive information copied to the global clipboard. For example, passwords being copy-and-pasted from a password manager app could be captured by another application installed on the device.[1]
On Android, ClipboardManager.OnPrimaryClipChangedListener can be used by applications to register as a listener and monitor the clipboard for changes.[2]
Android 10 mitigates this technique by preventing applications from accessing clipboard data unless the application is on the foreground or is set as the device’s default input method editor (IME).[3]
| ID | Name | Description |
|---|---|---|
| S0421 | GolfSpy | |
| S0295 | RCSAndroid |
RCSAndroid can monitor clipboard content.[5] |
| S0297 | XcodeGhost |
XcodeGhost can read and write data in the user’s clipboard.[6] |
| ID | Mitigation | Description |
|---|---|---|
| M1005 | Application Vetting |
Applications could be vetted for their use of the clipboard manager APIs with extra scrutiny given to application that make use of them. |
| M1006 | Use Recent OS Version |
Android 10 prevents applications from accessing clipboard data unless the application is on the foreground or is set as the device’s default input method editor (IME).[3] |
Capturing clipboard content can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.