Perimeter
9/26/2011
11:07 PM
Gadi Evron
Gadi Evron
Commentary
50%
50%

Eavesdropping Trojans Used In Cell Phone Spying Case

Israeli case a reminder of all types of social engineering threats

A story broke out recently in Israel about the arrest of 22 private investigators over the wide-use of eavesdropping Trojan horses for cell phones. This one also has an interesting solution for discovering the attack.

Reportedly, the Trojan horse, called "SpyPhone," costs (depending on target phone) between $1,500 and $2,500. Its capabilities vary from recording conversations and opening the microphone to listening to the room the phone is in.

The technology is available for multiple phones, from an ancient Nokia 5500 to a modern iPhone. While it is obvious the capabilities of the Trojan horse change with how advanced the phone is, the attack vectors seem to be human -- social engineering.

It has been reported that automatic attacks have been used previously by use of software vulnerabilities, and some are still rumored. However, that does not seem to be the case here. The infection vectors varied from asking someone for his phone for a few seconds, sending an SMS and receiving a download link, to downloading it directly. Other approaches, such as SMS and MMS lures to get the target user to click on a link, are also suspected.

Local police intend to take this investigation forward to also investigate the clients of the PI's, and it is rumored that many of those are wives wishing to spy on their husbands.

This is not the first time such a case was prosecuted in Israel. In 2005, private investigators in Israel used a Trojan horse to perform industrial espionage. Dozens of international, high-tech companies were implicated, either as clients of private intelligence companies that did the spying or as the victims.

The case from 2005 was the first real (and public) example of industrial espionage by the use of Trojan horses with computers. While it is clear that espionage by the use of cell phones and with Trojan horses isn't new, this Israeli case once again brings to light that these risks are in actuality threats -- real and demonstrated.

White such targeted attacks, especially when used in combination with 0-day vulnerabilities (or as some people like to call them these days, APTs) are difficult to discover, unlike on the PC, cell phones do not provide us with as many options other than returning the machine to company settings (hoping that it was a software matter).

That is not a scalable solution, and it is my hope that new solutions will be designed into future phones, rather than someone making a buck off of mostly useless (for such attacks) antiviruses for cell phones.

There is, however, a solution for finding out if you are a victim in this specific case, as suggested on a Hebrew news site ynet: As this Trojan horse is reported to send an SMS to its masters if the SIM card on the phone is changed. Change it. Buy a disposable SIM for $10. Then check your balance to see if it was reduced by a few cents. If it was, you're being spied upon.

This is a brilliant and simple solution -- but, naturally, only if this is how the Trojan horse actually works, and until such time as the makers of the program update it to counter this. The program is sold legally, even though the website looks shady. It is the malicious use by the PIs that's illegal.

Gadi Evron is an independent security strategist based in Israel. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

CVE-2014-7880
Published: 2014-12-17
Multiple unspecified vulnerabilities in the POP implementation in HP OpenVMS TCP/IP 5.7 before ECO5 allow remote attackers to cause a denial of service via unspecified vectors.

CVE-2014-8133
Published: 2014-12-17
arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.