Slashdot Mirror
PlaceRaider Builds a Model of Your World With Smartphone Photos
Hugh Pickens writes "Neal Ungerleider writes about PlaceRaider, a trojan that can run in the background of any phone running Android 2.3 or above, and is hidden in a photography app that gives PlaceRaider the necessary permissions to access the camera and upload images. Once installed, PlaceRaider quietly takes pictures at random that are tagged with the time, location, and orientation of the phone while muting the phone's shutter sound. Once pictures are taken, PlaceRaider uploads them to a central server where they are knitted together into a 3D model of the indoor location where the pics were taken. A malicious user can then browse this space looking for objects worth stealing and sensitive data such as credit card details, identity data or calender details that reveal when the user might be away. If a user's credit card, bank information, or personal information happen to be out in the open — all the better. — the software can identify financial data, bar codes, and QR codes. End users will also be able to get the full layout of a victim's office or room. The good news? PlaceRaider isn't out in the wild yet. The malware was built as an academic exercise by a team at Indiana University as a proof of concept to show the invasive potential of visual malware beyond simple photo or video uploads and demonstrate how to turn an individual's mobile device against himself (PDF), creating an advanced surveillance platform capable of reconstructing the user's physical environment for exploration and exploitation. 'The message is clear — this kind of malware is a clear and present danger. It's only a matter of time before this game of cat and mouse becomes more serious.'" As malware, it's spooky. But merely as software, this kind of intelligent 3-D imaging is something I'd like to be able to do with my phone.
Put your phone in your pocket when not using it. Problem solved.
Proud member of the Ferengi Socialist Party.
How much data does it use?? as people on capped plan will see a big spike in data uses that may tip them off to software like this.
...while muting the phone's shutter sound.
Many Android phones require root privilege to mute shutter sound...Some of them allows screenshot of camera preview without it...but not all of them...rooting methods usually differ from phone model to model, and becoming more and more advanced. Some phones have security features like custom LSM modules, NAND tamper checking on boot, or MDM tools built into the kernel. I wonder how this malware dodge this problem.
I could do without the random pictures and uploading to a rogue site, but I would like to ask that the part where it silences the fake shutter sound be released into the wild, and we all agree not to fix it. My I also request that this no-fake-sounds malware be extended to touch keyboards as well?
Is it just my observation, or are there way too many stupid people in the world?
This is why I/O components need hardware on/off switches.
The radio(s), the screen, the touch surface, the camera(s), the speaker, the microphone, the buttons other than of course the "buttons on/off" button need to be either hardware controlled or controlled by immutable, bug-free software.
If I flip the "camera" switch to off, it should be off, and no software in the world should be able to turn it on.
Ditto the cellular radio, wifi, screen, speaker, touch surface, most of the buttons, etc. etc.
If the phone has a master power off button or switch, turning it off should be pretty much like removing the battery except the "turn phone on" button would still work. Not even the "wake on alarm" or "wake on LAN" functions should work. If you need those functions, use the "regular" on/off button, not the "master on/off" button or switch.
Computers and other electronics should have similar on-off buttons. At a minimum, they should have a "master power" button and, typically, a "normal" on/off button. "Normal" being what we normally think of as "on/off" - most functions off but a few, like wake-on-certain-events, turned on.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Found this off a search for "cheapest Nokia":
"The Nokia 103 is dust resistant, comes with an âoeanti-scratch coverâ, has a 1.36 inch black and white display, flashlight, an FM radio (requires a headset), and an 800 mAh battery that should give you 27 days of standby time or 11 hours of talk time. Size and weight: 107.2 mm x 45.1 mm x 15.3 mm; 77 grams."
16 Euros or $21. No camera.
'nuff said.
I'm not a lawyer, but I play one on the Internet. Blog
If my phone is "on" I want the option to individually turn off the mic, speaker, radios, and cameras in a non-overrideable way.
If I'm in a museum or meeting, I'll hardware-mute the speaker and possibly the mic, camera, and radios if recording or radio transmission is not allowed in that museum or meeting. Why hardware-mute? To give the museum owner or meeting chair confidence that my device isn't compromised so he'll allow me to use it to look up locally-stored data and take written notes.
If I'm in an airplane, I'll cut off whatever components the pilot asks me to in hardware.
As long as malware that can turn these things on exists, why should a museum, meeting chair, pilot, or the FAA trust my phone to not violate the rules unless the phone is built in a way that there's an obvious way to follow the rules without removing the battery.
Outside of these situations, I'll probably have abusable features like the mic and camera hardware-off when I'm not using them.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Security-minded businesses or governments may want their phones to include a separate computer in the phone that logs the time and, if available, GPS location any time the mic or camera is turned on and perhaps data relating to radio use, with the information stored in a place that the regular phone hardware and softare can't get to. This will provide evidence if an employee is accused of misusing his phone to record things he shouldn't be recording or, if the employee denies the act, evidence that the phone may be compromised.
Totalitarian governments may want all phones to record all I/O and send copies to a central police agency. Or at least they'll want their citizens to think their phones do this to deter use of the device for anti-government purposes.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
These kind of thoughts make the Google glass project fascinating and terrifying. Street View the world. Capture all the print material. How much more?
About how walled gardens are bad?
-- Two men say they're Jesus. One of them must be wrong. - Dire Straits
Have you seen how street view works? Obviously not, AC. It uses a camera OUTSIDE of the car to take pictures of the entire range in view of the camera, including the sky. Your plan makes for terrible pictures through people dirty windshields.
There Can Be Only One...
Either Hugh Pickens didn't read the pdf or he is trying to intentionally misinform. A simple glance at the 1 Megapixel reconstruction shows that this would be impossible.
I actually think this is about getting Navy funding, because their entire premise - that people walk around pointing their phones at everything around them, is absurd. 99% of the pictures you would get from my phone would be useless, and consist of pictures that are of the ceiling, blacked out because my phone is on the table, blacked out because my phone is in my pocket, blacked out because my finger is over the camera lens as I talk, or blurry from the motion of moving it from the table or pocket to my ear.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Have you tried 123D Catch from Autodesk? It builds a 3D model from a few photos. Free:
http://www.123dapp.com/catch
Taking pictures in your private space may be embarrassing and may expose your mistress or illegal pot plants to the world, but as far as burglars go, it is irrelevant: they can tell easily whether your house is worth breaking into from the outside. And the idea that a bunch of dim-wit burglars are using poor quality 3D models to plan their heist wouldn't even fly as a movie plot.
This project strengthens the ludicrous idea in people's heads that photography is somehow a significant threat to safety or security. Photographic documentation is an extremely important part of modern democracy, and projects like these threaten the ability of people to take pictures.