Perimeter
9/26/2011
11:07 PM
Gadi Evron
Gadi Evron
Commentary
50%
50%

Eavesdropping Trojans Used In Cell Phone Spying Case

Israeli case a reminder of all types of social engineering threats

A story broke out recently in Israel about the arrest of 22 private investigators over the wide-use of eavesdropping Trojan horses for cell phones. This one also has an interesting solution for discovering the attack.

Reportedly, the Trojan horse, called "SpyPhone," costs (depending on target phone) between $1,500 and $2,500. Its capabilities vary from recording conversations and opening the microphone to listening to the room the phone is in.

The technology is available for multiple phones, from an ancient Nokia 5500 to a modern iPhone. While it is obvious the capabilities of the Trojan horse change with how advanced the phone is, the attack vectors seem to be human -- social engineering.

It has been reported that automatic attacks have been used previously by use of software vulnerabilities, and some are still rumored. However, that does not seem to be the case here. The infection vectors varied from asking someone for his phone for a few seconds, sending an SMS and receiving a download link, to downloading it directly. Other approaches, such as SMS and MMS lures to get the target user to click on a link, are also suspected.

Local police intend to take this investigation forward to also investigate the clients of the PI's, and it is rumored that many of those are wives wishing to spy on their husbands.

This is not the first time such a case was prosecuted in Israel. In 2005, private investigators in Israel used a Trojan horse to perform industrial espionage. Dozens of international, high-tech companies were implicated, either as clients of private intelligence companies that did the spying or as the victims.

The case from 2005 was the first real (and public) example of industrial espionage by the use of Trojan horses with computers. While it is clear that espionage by the use of cell phones and with Trojan horses isn't new, this Israeli case once again brings to light that these risks are in actuality threats -- real and demonstrated.

White such targeted attacks, especially when used in combination with 0-day vulnerabilities (or as some people like to call them these days, APTs) are difficult to discover, unlike on the PC, cell phones do not provide us with as many options other than returning the machine to company settings (hoping that it was a software matter).

That is not a scalable solution, and it is my hope that new solutions will be designed into future phones, rather than someone making a buck off of mostly useless (for such attacks) antiviruses for cell phones.

There is, however, a solution for finding out if you are a victim in this specific case, as suggested on a Hebrew news site ynet: As this Trojan horse is reported to send an SMS to its masters if the SIM card on the phone is changed. Change it. Buy a disposable SIM for $10. Then check your balance to see if it was reduced by a few cents. If it was, you're being spied upon.

This is a brilliant and simple solution -- but, naturally, only if this is how the Trojan horse actually works, and until such time as the makers of the program update it to counter this. The program is sold legally, even though the website looks shady. It is the malicious use by the PIs that's illegal.

Gadi Evron is an independent security strategist based in Israel. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9710
Published: 2015-05-27
The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time windo...

CVE-2014-9715
Published: 2015-05-27
include/net/netfilter/nf_conntrack_extend.h in the netfilter subsystem in the Linux kernel before 3.14.5 uses an insufficiently large data type for certain extension data, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via outbound network traffic that trig...

CVE-2015-1157
Published: 2015-05-27
CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2)...

CVE-2015-2666
Published: 2015-05-27
Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to t...

CVE-2015-2830
Published: 2015-05-27
arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrate...

Dark Reading Radio
Archived Dark Reading Radio
After a serious cybersecurity incident, everyone will be looking to you for answers -- but you’ll never have complete information and you’ll never have enough time. So in those heated moments, when a business is on the brink of collapse, how will you and the rest of the board room executives respond?