Perimeter
9/26/2011
11:07 PM
Gadi Evron
Gadi Evron
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Eavesdropping Trojans Used In Cell Phone Spying Case

Israeli case a reminder of all types of social engineering threats

A story broke out recently in Israel about the arrest of 22 private investigators over the wide-use of eavesdropping Trojan horses for cell phones. This one also has an interesting solution for discovering the attack.

Reportedly, the Trojan horse, called "SpyPhone," costs (depending on target phone) between $1,500 and $2,500. Its capabilities vary from recording conversations and opening the microphone to listening to the room the phone is in.

The technology is available for multiple phones, from an ancient Nokia 5500 to a modern iPhone. While it is obvious the capabilities of the Trojan horse change with how advanced the phone is, the attack vectors seem to be human -- social engineering.

It has been reported that automatic attacks have been used previously by use of software vulnerabilities, and some are still rumored. However, that does not seem to be the case here. The infection vectors varied from asking someone for his phone for a few seconds, sending an SMS and receiving a download link, to downloading it directly. Other approaches, such as SMS and MMS lures to get the target user to click on a link, are also suspected.

Local police intend to take this investigation forward to also investigate the clients of the PI's, and it is rumored that many of those are wives wishing to spy on their husbands.

This is not the first time such a case was prosecuted in Israel. In 2005, private investigators in Israel used a Trojan horse to perform industrial espionage. Dozens of international, high-tech companies were implicated, either as clients of private intelligence companies that did the spying or as the victims.

The case from 2005 was the first real (and public) example of industrial espionage by the use of Trojan horses with computers. While it is clear that espionage by the use of cell phones and with Trojan horses isn't new, this Israeli case once again brings to light that these risks are in actuality threats -- real and demonstrated.

White such targeted attacks, especially when used in combination with 0-day vulnerabilities (or as some people like to call them these days, APTs) are difficult to discover, unlike on the PC, cell phones do not provide us with as many options other than returning the machine to company settings (hoping that it was a software matter).

That is not a scalable solution, and it is my hope that new solutions will be designed into future phones, rather than someone making a buck off of mostly useless (for such attacks) antiviruses for cell phones.

There is, however, a solution for finding out if you are a victim in this specific case, as suggested on a Hebrew news site ynet: As this Trojan horse is reported to send an SMS to its masters if the SIM card on the phone is changed. Change it. Buy a disposable SIM for $10. Then check your balance to see if it was reduced by a few cents. If it was, you're being spied upon.

This is a brilliant and simple solution -- but, naturally, only if this is how the Trojan horse actually works, and until such time as the makers of the program update it to counter this. The program is sold legally, even though the website looks shady. It is the malicious use by the PIs that's illegal.

Gadi Evron is an independent security strategist based in Israel. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6117
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.