Perimeter
9/26/2011
11:07 PM
Gadi Evron
Gadi Evron
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Eavesdropping Trojans Used In Cell Phone Spying Case

Israeli case a reminder of all types of social engineering threats

A story broke out recently in Israel about the arrest of 22 private investigators over the wide-use of eavesdropping Trojan horses for cell phones. This one also has an interesting solution for discovering the attack.

Reportedly, the Trojan horse, called "SpyPhone," costs (depending on target phone) between $1,500 and $2,500. Its capabilities vary from recording conversations and opening the microphone to listening to the room the phone is in.

The technology is available for multiple phones, from an ancient Nokia 5500 to a modern iPhone. While it is obvious the capabilities of the Trojan horse change with how advanced the phone is, the attack vectors seem to be human -- social engineering.

It has been reported that automatic attacks have been used previously by use of software vulnerabilities, and some are still rumored. However, that does not seem to be the case here. The infection vectors varied from asking someone for his phone for a few seconds, sending an SMS and receiving a download link, to downloading it directly. Other approaches, such as SMS and MMS lures to get the target user to click on a link, are also suspected.

Local police intend to take this investigation forward to also investigate the clients of the PI's, and it is rumored that many of those are wives wishing to spy on their husbands.

This is not the first time such a case was prosecuted in Israel. In 2005, private investigators in Israel used a Trojan horse to perform industrial espionage. Dozens of international, high-tech companies were implicated, either as clients of private intelligence companies that did the spying or as the victims.

The case from 2005 was the first real (and public) example of industrial espionage by the use of Trojan horses with computers. While it is clear that espionage by the use of cell phones and with Trojan horses isn't new, this Israeli case once again brings to light that these risks are in actuality threats -- real and demonstrated.

White such targeted attacks, especially when used in combination with 0-day vulnerabilities (or as some people like to call them these days, APTs) are difficult to discover, unlike on the PC, cell phones do not provide us with as many options other than returning the machine to company settings (hoping that it was a software matter).

That is not a scalable solution, and it is my hope that new solutions will be designed into future phones, rather than someone making a buck off of mostly useless (for such attacks) antiviruses for cell phones.

There is, however, a solution for finding out if you are a victim in this specific case, as suggested on a Hebrew news site ynet: As this Trojan horse is reported to send an SMS to its masters if the SIM card on the phone is changed. Change it. Buy a disposable SIM for $10. Then check your balance to see if it was reduced by a few cents. If it was, you're being spied upon.

This is a brilliant and simple solution -- but, naturally, only if this is how the Trojan horse actually works, and until such time as the makers of the program update it to counter this. The program is sold legally, even though the website looks shady. It is the malicious use by the PIs that's illegal.

Gadi Evron is an independent security strategist based in Israel. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web