PlaceRaider Builds a Model of Your World With Smartphone Photos

Hugh Pickens writes "Neal Ungerleider writes about PlaceRaider, a trojan that can run in the background of any phone running Android 2.3 or above, and is hidden in a photography app that gives PlaceRaider the necessary permissions to access the camera and upload images. Once installed, PlaceRaider quietly takes pictures at random that are tagged with the time, location, and orientation of the phone while muting the phone's shutter sound. Once pictures are taken, PlaceRaider uploads them to a central server where they are knitted together into a 3D model of the indoor location where the pics were taken. A malicious user can then browse this space looking for objects worth stealing and sensitive data such as credit card details, identity data or calender details that reveal when the user might be away. If a user's credit card, bank information, or personal information happen to be out in the open — all the better. — the software can identify financial data, bar codes, and QR codes. End users will also be able to get the full layout of a victim's office or room. The good news? PlaceRaider isn't out in the wild yet. The malware was built as an academic exercise by a team at Indiana University as a proof of concept to show the invasive potential of visual malware beyond simple photo or video uploads and demonstrate how to turn an individual's mobile device against himself (PDF), creating an advanced surveillance platform capable of reconstructing the user's physical environment for exploration and exploitation. 'The message is clear — this kind of malware is a clear and present danger. It's only a matter of time before this game of cat and mouse becomes more serious.'" As malware, it's spooky. But merely as software, this kind of intelligent 3-D imaging is something I'd like to be able to do with my phone.

Comments

Pocket

[leromarinvit]

Put your phone in your pocket when not using it. Problem solved.

Re:Pocket

[leromarinvit]

It gonna be hard to keep your hand on the lens at all time, you could make the phone recognize big moves that correspondent closely to being taken out of the pocket. From there you may be able to get a few pictures every time its taken out. Also using the mic to recognize when somebody is talking in it gonna give you a good idea on when its being used and thus out of the pocket.

I guess you could get some data that way, but I doubt it would be very much. All these things (constantly making photos, trying to get a GPS fix, reading sensor/mic data) will suck power like mad. If my phone's battery suddenly only lasts 3 or 4 hours, I'm going to investigate what's going on. Uninstall recently installed apps, look what background processes are running, do a factory reset if nothing helps. Less technically inclined people would probably ask their nerd friends for help or take it to a shop.

Re:Pocket

[leromarinvit]

Because Apple would never approve malware in the app store? Right.

They don't have the source code to submitted apps, so they couldn't review it even if they wanted to.

Re:Pocket

[drkim]

Researcher comes out with yet another bonafide [sic] security flaw on Android, and you make it yet another iHater Apple bash..

Oh. I see. When some Anonymous Coward posts, "Buy an iPhone." in a thread about Android phones, that's OK.

But if we respond to that specific comment with an (obviously) humorous comment about iPhone users taking themselves too seriously; that we're 'Childish.' and we're just (and I quote) "...sticking it to the 'Apple Man.'"

Well, thank you Apple user, for showing us how you, um, don't take yourself too seriously...

very bad

[kenorland]

Taking pictures in your private space may be embarrassing and may expose your mistress or illegal pot plants to the world, but as far as burglars go, it is irrelevant: they can tell easily whether your house is worth breaking into from the outside. And the idea that a bunch of dim-wit burglars are using poor quality 3D models to plan their heist wouldn't even fly as a movie plot.

This project strengthens the ludicrous idea in people's heads that photography is somehow a significant threat to safety or security. Photographic documentation is an extremely important part of modern democracy, and projects like these threaten the ability of people to take pictures.