‘SAW’-ing through the UI: Android overlay malware and the System Alert Window permission explained