Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

Android Spyware Has Ties to Election Interference

Recently revealed surveillance-ware comes from a consultant with close ties to Russia's GRU who was sanctioned by the US for election-tampering.

A newly discovered Android malware strain has been tied to a US-sanctioned contractor with close connections with Russia's GRU.

According to researchers at Lookout, who found and dubbed the malware as Monokle, is able to steal personal information from an infected device and send it to any of a series of command-and-control (C2) servers. One of the unique aspects of Monokle is that it doesn't need root access to collect its information. Instead, it uses a series of existing techniques in novel ways to get a more complete picture of the user's data, interests, and on-line habits.

"The malware has a unique set of features. It can modify the Android device's trusted root certificate, capture the screen unlock sequence, and capture the auto-complete dictionary, among other things. It's very complete surveillance-ware," says Adam Bauer, senior staff security intelligence engineer at Lookout.

Monokle's source has been traced back to Special Technology Center (STC), a Russian defense contractor sanctioned for its role in interfering with the 2016 US presidential election. "The first reason Monokle is notable is because of its ties to a Russian government defense contractor who is also producing antivirus for Android," says Tim Erlin, vice president of product management and strategy at TripWire. "The second reason it's notable is because of the extent to which it's able to gather data and take advantage of of a mobile device."

According to the Lookout report, Monokle's ties to STC and the Android antivirus software are found in the code. "STC has been developing a set of Android security applications, including an antivirus solution, which share infrastructure with Monokle," the report states.

Lookout determined that Monokle is targeting very specific individuals because of the applications that carry the infection. Christoph Hebeisen, senior manager, security intelligence at Lookout, believes the surveillance-ware's qualities mean that it most likely will remain a tool for spying on high-value targets.

"Ultimately, we believe that this type of software is most likely to be used in targeted attacks, so whether you worry about it or not depends on your threat model," he says.

The Lookout researchers and Erlin point out, though, that there's nothing inherent in Monokle's technology that limits it to a particular target. "In this case, where we're talking about a tool that's been discovered in the wild and analyzed, the use of that tool that's been seen so far has been targeted," Erlin says. "But that doesn't mean that the tool itself couldn't be used in a variety of ways."

Bauer says that the Monokle code was first found in the wild in samples collected in 2016, but the code wasn't initially analyzed and found to be malicious until early 2018. Analysis has continued and more details have become clear. "We decided to go public now because of the relevance of this particular threat," Bauer says. "Once we found that the creator was STC, it became more relevant because the company has been sanctioned due to their connection to GRU in terms of election meddling."

Erlin says there are specific steps individuals and organizations can take to reduce their risk from the spyware: don't install apps from untrusted sources or from unknown third-party sources, and install mobile antivirus, he says.

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

 

 

 

 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
bwilkes8@gmail.com
100%
0%
[email protected],
User Rank: Moderator
7/26/2019 | 11:03:55 AM
RE: Android Spyware Has Ties to Election Interference
Good article, well balanced, however what if were mentioned that all users of the campaign party that were "hacked" opened spear phished and took the worm.  The penetration of their machines, the network and DNC was due to EMPLOYEES not adhering to basic security practices.  So there article might have included more insight, links and references to such tactics and how to detect them.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...