Slashdot Mirror
Android Trojan Records Phone Calls
jbrodkin writes "A new Android Trojan is capable of recording phone conversations, according to a CA security researcher. While a previous Trojan found by CA logged the details of incoming and outgoing phone calls and the call duration, new malware identified this week records the actual phone conversations in AMR format and stores the recordings on the device's SD card. The malware also 'drops a 'configuration' file that contains key information about the remote server and the parameters,' CA security researcher Dinesh Venkatesan writes, perhaps suggesting that the recorded calls can be uploaded to a server maintained by an attacker. Installation of the Trojan requires some user interaction, but the malware recreates the look and feel of the standard Android application installation process, and may fool some unsuspecting users."
So I have to rootkit my own phone in order to record anything but this trojan can just record everything on its own? What a scam! I'm glad it takes a virus writer to extract what I consider to be a basic functionality out of my phone.
This is an application that records phone calls. It tells you it will do this when you install it and it will require you opt to install it from an untrusted site after configuring your phone to allow such an action.
But then I guess "phone call recording app records phone calls" is less of an alarmist title.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
This application, even just the fear of the possibility of it running, will instill a lot of fear in those using their phone for personal relationship infidelity,
Variants of this application are apt to become very popular amongst those suspecting their relationships are not pure.
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
Not to disagree with your point but...why do you want apps running "in a chroot jail" when none of the apps on the whole phone, even mission critical apps like the dialer, already run as an unprivileged user?
I think you're confusing root with having write permissions to the SD card or something here. Without manually rooting the phone itself, NOTHING ON THE WHOLE DEVICE runs as root. Placing every app in a jail is just going to add a small amount of additional memory overhead for every process.
Perhaps more to your point though, the real solution here is to uncover the console a little. I know, I know, GUIs are great and all that, but the nice thing about seeing "root@box" before every single command you ever execute is that there's no doubt in your mind what user is starting the process, and what permissions that process will have.
A good solution for this would be something like Launchy (google it) for android, with a special icon to denote when the program you're starting will be running with root permissions. Of course, unless the ROM is rooted, none of them are, but even now I sometimes forget I gave a certain app superuser permissions and it would be nice to have a reminder. Not a warning. A popup dialog is never a good answer! However, a simple icon beside the program in the app drawer that designates it'll run as root by default would be nice.
In any case, the proper solution to security is smarter users plus unobtrusive notification. Popup warnings and outright denial do nothing but frustrate users and force them to use a less annoying - and less safe - means to accomplish whatever it is they're damn well going to do anyway.
Keep your hard and fast rules in the firewall. Everything within the network is going to require smarter people to function anyway.
Check out the excellent Droidwall app. It requires root of course to run iptables, but shouldn't we all have root on our phones?
To the GP, I agree android should support finer grained permissions (and each version of the OS has more perms) in addition to selecting which permissions the user wants to grant the app! (Not just "OK" to allow all the permissions the app asks for, but the user could pick and choose which perms to give it; obviously not granting some perms would cripple some apps..) Without that ability, Droidwall at least blocks internet connectivity for all apps in whitelist mode.
And you will both learn when running Droidwall that each app runs as its own user on the phone. Hence it gives you the requested GUI to allow each app access to the net (over 3G and/or wifi).
Nothing new.
I want all apps to run in a chroot jail.
Why do you need a chroot, if you can just set permissions such that the app can only see what it needs to see?
And Android does that already. System partition is by and large off-limits. Each app gets its own directory with full access to itself and no-one else, which is the default storage location. SD card (or whatever is mounted to /sdcard - on phones like Nexus S, it's just a separate partition) is shared between all.
The linked article (and the blog post that it links to) doesn't say what makes the app a trojan as opposed to functionality the user may have actually been intending to install. What was the app pretending to be? Scaremongering, or just a poorly written blog post?
Android has strict permissions enforcement for every application. It's even built into the marketplace! You cannot install an application without first being told WHAT the application wants access to. If the application wants to record your phone calls, the installer will specifically tell you the application is requesting access to your microphone. The installer forces you to scroll down to hit next, and there is literally NO WAY you can miss reading it. If you install applications from an untrusted source, Android will specifically WARN YOU that you could be installing something dangerous. The above article is nothing but FUD. If you read the source article, it says you have to install from an untrusted source, go through the warnings, and still go through the installation process.
You have to install it from an untrusted source. If you go to an android phone Application->Settings and manually enable "Allow the installation of apps from untrusted sources" Then add the untrusted source that hosts malware then you will be able to install it. In other words you have to go out of your way to get infected. You know... leave the garden of Google Marketplace. Most people that choose to exercise that choice (Which Dear Leader Steve does not allow on your iPhone) will know to be careful when adding Chinese malware sources to their Android.
Why do you need a chroot, if you can just set permissions such that the app can only see what it needs to see?
And Android does that already. System partition is by and large off-limits. Each app gets its own directory with full access to itself and no-one else, which is the default storage location. SD card (or whatever is mounted to /sdcard - on phones like Nexus S, it's just a separate partition) is shared between all.
Some applications will not run if they can't have access to the filesystem. I would still like to run these applications. The Chroot jail would allow you to present a fake filesystem to the application that it can change however it wants without breaking anything else. The same thing can be extended to other areas. App refuses to run without seeing your contacts? Here, have a fake address book.
I want all apps to run in a choad jail.
FTFY! You're welcome.
-- Flame me and I will happily flame you back. Bring it!
So in other words: Android is secure because every human being should be perfectly capable of reading dialogs, groking the details, and making use of trusted sources instead of untrusted ones. All the people who aren't reading articles, groking their details, and referring to trusted article sources are obviously spreading FUD about how Android treats the issue of security.
(It can upload the recordings ) to a malicious user. Read the fucking summary.
I just did. It says perhaps suggesting. There is no actual indication that it can even do so; that behavior was not observed on the two emulators they ran the software on and it doesn't look like they even tried to reverse engineer it.
Here's the link to the actual article by the CA researcher: http://community.ca.com/blogs/securityadvisor/archive/2011/08/01/a-trojan-spying-on-your-conversations.aspx
Some items to note:
1. Nowhere does he provide reasoning or justification for why this software is being considered Malicious, much less a Trojan.
2. He claims that it "tricks users" by presenting a window which appears to look like a normal Android Install window. But then he says it requires the user to actually grant permissions... so that doesn't just "look like" a normal install window, it IS a normal install window. Additionally, the only way to install it is via a 3rd party store... so the user has to somehow enable 3rd party app store installs as well.
3. As for the malicious nature of the program- he seems to be taking offense to it recording calls. Or storing the recordings. He never says what he's calling "malicious". He speculates that some server info stored in a local file is an indicator that it might be able to upload data. Again, no logic behind why this is malicious and an FTP program is not.
4. There is absolutely NO evidence that this allows any kind of remote access to the phone. There is no evidence it is actually trying to connect to a remote server, or upload automatically.
5. This software was never tested on an actual device- he used two emulators.
So without knowing anything about how this software is advertised, it is by definition impossible to determine if it's a Trojan or not. And so far there isn't any evidence that it's doing anything malicious at all. In fact, I really don't see how this software is ANY different than any of the other applications which allow in-call recording.
Let's see the source.
Oh, I agree that's a problem -- which is why I would love the ability for the user to decide which permissions to grant. The app requests them, and the user grants/denies them on a fine-grained basis.
However, Angry Birds on Android (all 3 versions) do not request access to the contact list. At least the ones I downloaded from the market. They all want internet access though, and the standard version wants GPS location.