SMS-Controlled Malware Hijacking Android Phones
wiredmikey writes "Security researchers have discovered new Android malware controlled via SMS that can do a number of things on the compromised device including recording calls and surrounding noise. Called TigerBot, the recently discovered malware was found circulating in the wild via non-official Android channels. Based on the code examination, the researchers from NQ Mobile, alongside researchers at North Carolina State University said that TigerBot can record sounds in the immediate area of the device, as well as calls themselves. It also has the ability to alter network settings, report its current GPS coordinates, capture and upload images, kill other processes, and reboot the phone. TigerBot will hide itself on a compromised device by forgoing an icon on the home screen, and by masking itself with a legit application name such as Flash or System. Once installed and active, it will register a receiver with a high priority to listen to the intent with action 'android.provider.Telephony.SMS_RECEIVED.'"
Security Alert: New Android Malware — TigerBot — Identified in Alternative Markets
And frist?
I am Slashdot. Are you Slashdot as well?
... such as Flash...
I'm sure there's a joke in here somewhere, but I can't find it...
And quietly wondering what "SMS-Controlled Mahjong Android Phones" were?
Support the EFF and Creative Commons. The war is coming, and they're supporting you...
Dr. Xuxian Jiang has been busy identifying all sorts of Android malware.
I am Slashdot. Are you Slashdot as well?
Downloading things from backwater websites has a higher risk of malware being present than downloading from reputable sources. ...That's some fine detective work there, Lou.
More seriously; It shouldn't come as any surprise that given how valuable your location data and personal information is, and how much of that is stored on a cell phone, and how most companies have declared themselves to have absolute rights to it (go ahead, try and stop us! *evil overlord laugh*), it shouldn't be surprising that other people (legitimately or otherwise) are hopping on the "All Your Privacy Are Belong To Us" gravy train.
So people will be all like "Oh noes! Someone wrote an evil bot!" ... Of course, they'll forget that the malware that the telecos have loaded on your phone makes that look positively amateur.
#fuckbeta #iamslashdot #dicemustdie
If you root your phone, your phone could be rooted!
I can't record my own audio on my Android phone but a malware app can? So let me get this straight - to get what I believe should be a regular functionality I have to have someone install a malware app? Ridiculous. This is almost like giving someone syphillis to cure them of AIDS!
This is not the first Android malware reported, and the story is always missing three key pieces of information:
1) What applications (or sites) were hosting the malware so that we can check to see if we have those apps.
2) How to tell if you are infected (and saying "it will register a receiver with a high priority to listen to the intent with action 'android.provider.Telephony.SMS_RECEIVED" doesn't really explain anything, especially to the layperson).
3) What to do about it if you are infected.
This story is no different
"Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
ohh please stop trolling and use the Market/Play search box
... my kingdom for a mod point...
XML is a known as a key material required to create SMD: Software of Mass Destruction
Was going to mod you down, but I'll post instead. Did you even LOOK at the results page you linked to? There are a handful of call recording apps (which don't seem to work on most phones. I've tried all of the ones on page 1 on both my Moment and my Evo 4G), and nine hundred and something apps with the word "call" or "record" somewhere in there.
You'd think that an app store run by google would have smarter search capabilities...
I guess nobody ever roots their iPhones to install homebrew software. All of those rooting videos on youtube must be my imagination.
@AC - Just because YOU don't have a need or desire to install software from alternative sources doesn't mean nobody else should. That's not even a platform specific desire. Apple or Android - if you own a smartphone you have a portable computer in your pocket. There will always be people who want to tinker and think outside the box and push the limits of what they can do WITH A DEVICE THEY OWN. They shouldn't have to play by Apple's rules, Google's rules, or yours. It doesn't make them 'fandroids', it makes them curious.
This is not available on AndroidMarket/GooglePlay, so how widespread is it?
"TigerBot hasnâ(TM)t yet surfaced in Google Play (formerly Googleâ(TM)s Android Market) but does appear to be making the rounds on alternative markets." TFA
Join the Slashcott! Feb 10 thru Feb 17!
ohh please stop trolling and use the Market/Play search box
At last check (which, granted, was several months ago) all "call recording" apps for the DX do not record the call stream, but rather use the speaker to record calls through the mic.
But by all means, continue with your childish assumptions. After all, what fun would the internet be if everyone actually owned a clue?
An enigma, wrapped in a riddle, shrouded in bacon and cheese
A app store put together by Google has a crappy search engine. Talk about irony.
When I search for stuff in the Play Store (what a stupid name change) the problem usually isn't no results. The issues is there's no preferences to sort by highest rated or other criteria. Most searches return dozens of hits but it's a mixed bag as far as relevancy.
One solution would be to use Google Voice and allow the call to be recorded on Google's system. Then you can access the recording from your phone, your computer, etc. I got my GV number well before you could "port" a number to GV, so I got a new number. I know that is a deal breaker for some folks so look into porting your existing number to GV. It definitely lets you record calls with no problem at all.
I guess I should point out that the service is still mostly USA only.
One solution would be to use Google Voice and allow the call to be recorded on Google's system. Then you can access the recording from your phone, your computer, etc. I got my GV number well before you could "port" a number to GV, so I got a new number. I know that is a deal breaker for some folks so look into porting your existing number to GV. It definitely lets you record calls with no problem at all. I guess I should point out that the service is still mostly USA only.
Although my goal would be to have a local recording (i.e., process is not reliant on someone else's equipment), I'll have to check your solution out. While not ideal, it's better than nothing.
Much 'preciated.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
someone wrote the code that allows such recording
The same kind of hacks those applications do, so you want the same thing that malware do without the malware part, so I pointed you to the search where the first and second application tell you that there is no API for that and that they some tricks (that works on some devices
Replied.
WTF Slashdot, why do I have to login 50 times to post?
Not true.
Total Recall rings a bell. It's the app I was using to record calls before it started behaving badly on my S2 and I had to uninstall it (warez, say no more).
It was a fantastic app though.
This post contains benzene, nitrosamines, formaldehyde and hydrogen cyanide.
Using sipdroid with Google Voice or any SIP provider you can record calls locally, silently and if wanted, automatically. I assume other similar apps (like csipsimple) behave similarly, but I've only used sipdroid personally.
Google Voice alone will record calls if you press 4 during the call, but does not record locally and announces that you are recording to both sides of the call. You have to enable this feature first. See: http://support.google.com/voice/bin/answer.py?hl=en&answer=115082
As always, be familiar with the laws about recording telephone calls in your jurisdiction. If unsure, don't. ;)
Oh, and so you're aware, Google Voice (alone) cannot record outbound calls. Page linked in my previous post explains that as well. Apps such as sipdroid do not have this limitation.
Samsung S2 != Motorola DX
If I'm not mistaken (which I could be, as it's been some time since I researched this), Motorola actually locks the call stream access functionality out of their devices at the hardware level, meaning that no matter what, an app cannot access the inbound call stream.
Why they would do this to their customers is beyond me.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
As always, be familiar with the laws about recording telephone calls in your jurisdiction. If unsure, don't. ;)
Good advice; Fortunately, I live in a "one-party consent" state, meaning that so long as at least 1 person in the call knows it's being recorded, everything is legal beagle :D
An enigma, wrapped in a riddle, shrouded in bacon and cheese