Screen Sharing Detection

Android devices are capable of sharing (mirroring) their screen with another display. A screen can be shared either wirelessly or using a cable. Screen sharing can, however, pose a security risk, as sensitive information might be leaking from app screens. Screen sharing is also a vital feature of remote desktop apps that are frequently misused by fraudsters to steal from their victims.

Malwarelytics for Android is able to detect that the screen is being shared, it can block most of the screen sharing sessions, and can be configured to notify the app or terminate the app in case an app screen is shared.

Configuration

This feature can be configured during the Malwarelytics initialization phase:

val raspConfig = RaspConfig.Builder()
    .screenSharing(
        ScreenSharingConfig.Builder()
            .blockAction(BlockConfig)
            .blockLayout(ScreenSharingConfig.BlockLayout)
            .detectionAction(DetectionConfig)
            .build()
    )
    // configuration of other RASP features
    .build()

Available values of BlockConfig:

Available values of the ScreenSharingConfig.BlockLayout are:

List of available parameters for BlockLayout config values:

Available values of DetectionConfig:

Screen sharing detection defaults to DetectionConfig.Notify.

List of available parameters for some values of DetectionConfig:

Usage

After initialization, the screen sharing blocking feature is used based on the configuration. The screen sharing detection feature can be accessed via RaspManager. This can be used to register an observer or to trigger a manual screen sharing detection check.

The screen sharing blocking feature works independently of the screen sharing detection feature.

Registering an Observer

The screen sharing detection can trigger a certain action. To achieve that, an observer needs to be configured and registered.

Observer configuration:

val raspObserver = object : RaspObserver {
    // The callback is delivered on a background thread
    override fun onScreenSharingDetected(screenSharingDetection: ScreenSharingDetection) {
        // Handle screen sharing detection
    }
    // Handle detection of other RASP features
}

The observer can be registered in RaspManager. When it is no longer needed, it can be unregistered again.

raspManager.registerRaspObserver(raspObserver)
raspManager.unregisterRaspObserver(raspObserver)

The ScreenSharingDetection data class contains the following properties:

The nested ScreenSharingDetection.TransientScreenSharingData data class contains the following properties:

Available values of ScreenSharingDetection.DisplayChange

Triggering a Manual Check

The screen sharing detection check can be triggered manually in RaspManager. Two methods are available – isScreenShared() gives a simple boolean answer, whereas getScreenSharingDetection() provides more details.

val screenSharingDetection: ScreenSharingDetection = raspManager.getScreenSharingDetection()
val isScreenShared: Boolean = raspManager.isScreenShared()

Transient Detection Data

Detection data provided by the screen sharing detection feature are of two kinds - non-transient and transient. Non-transient data are both delivered via the RaspObserver.onScreenSharingDetected(ScreenSharingDetection) callback and can be queried via methods provided by the RaspManager. On the other hand, transient data are only delivered via the above-mentioned observer method. Transient data cannot be manually queried (and verified).

Unfortunately, screen sharing performed by some applications generates only transient data, which is either the detection of an added display or a removed display. These are typically virtual displays created by other apps.

The screen sharing blocking feature is able to block only non-transient detections; transient detections are not accessible for the blocking feature.

The returned data class ScreenSharingDetection contains the isScreenShared: Boolean property that is the primary indicator of a shared screen. This property contains only non-transient data. Some detections contain transient data in the transientData property.

As a simplification, the ScreenSharingDetection also contains isProblematic: Boolean and isTransientChange: Boolean properties. The first indicates whether the screen is being shared or a display was just added. The second indicates whether the detection contains a transient change. The transientData property contains information about the added or removed display.

Android Auto Detection

Android Auto detection data were added to the screen sharing detection data. These data are non-transient. They are both delivered in the observer callback and can be queried manually. They can also be queried independently (more detail in Android Auto Detection documentation).

Changes to the Android Auto connection also trigger the observer callback for screen sharing detection.