Insecure Permissions in YubiClip XOR Fork Allow OTP Clipboard Desynchronization

Executive Summary

This vulnerability involves insecure permissions in the YubiClip XOR app (version 1.0.1) that allows unauthorized apps to trigger the OTP-clipboard mechanism. The app's HandleOTPActivity copies a supplied string to the clipboard without verifying the caller or requiring user confirmation, enabling any installed app to overwrite clipboard content without interaction.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized clipboard modifications by monitoring apps with access to the HandleOTPActivity component. Use Android's logcat to inspect clipboard events with commands like 'adb logcat | grep -i clipboard'. Review installed apps for suspicious permissions or activities exporting sensitive components.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to overwrite your clipboard with malicious content, such as fake OTP codes or phishing links. This could lead to unauthorized access to accounts or tricking you into pasting harmful data. The attack is possible on Android 10+ due to relaxed activity start rules.

Useful 0 Not Useful 0

Mitigation Strategies

Uninstall YubiClip XOR v1.0.1 immediately. Disable the app's activity by setting android:exported="false" in its manifest if you must keep it temporarily. Avoid installing apps from untrusted sources and monitor clipboard behavior.

Useful 0 Not Useful 0