Slashdot Mirror
Music and Movies Could Trigger Mobile Malware
mask.of.sanity writes "Lights, sounds and magnetic fields can be used to activate malware on phones, new research has found. The lab-style attacks defined in a paper (PDF) used pre-defined signals hidden in songs and TV programmes as a trigger to activate embedded malware. Malware once activated would carry out programmed attacks either by itself or as part of a wider botnet of mobile devices."
to turn your phones off whilst watching a movie!
This sig is intentionally blank
Was a dingy rustic bar with Malcolm sitting talking to two twins and an ad appearing on TV for Fruity Oaty Bar...
Miranda...
Moved to http://soylentnews.org/. You are invited to join us too!
Fruity oaty bar
Make a man out of a mouse
Fruity oaty bar
Make you bust out of your blouse
Eat them all the time
They will blow your mind
Wo hen jiaonian diu lian - wo meiyou chi Fruity Oaty Bar!
Fruity oaty bars
Fruity oaty bars
Perhaps the phone could issue an alert if the movie you sat down to watch had a Rotten Tomatoes score below 30%...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Wouldn't the app have to carry the malware payload?
Isn't that the way the Cylons deactivated the Colonial ships in the BSG miniseries? Already installed malware activated when the sensors picked up a certain signal from the Cylons?
Lame article.
If you're already infected by malware, that malware can sit there and wait to do stuff any time it wants. Not exactly a big surprise.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
and that by Rick Astley. Researchers suspect it may be the beginning of the rise of machines against being forced to participate in human activities they find distasteful. The lead researcher also said that there's growing evidence that not only movies but also still images could have the same effect. When asked to elaborate, he mumbled something about goats and refused further comment.
I can just see it now. In a screening of the 1984 "Dune" flick or a superior remake, Paul Muadib is growling away working his weirding magic while everyone who left their phones on in the theater explodes.
It's really quite a simple choice: Life, Death, or Los Angeles.
research has proven the existance of the conditional statement.
Maybe the research was secretly funded by the RIAA and MPAA. In the future, devices will stop playing if they detect you hearing music or seeing images for which you haven't bought a license.
This just in -- any input on your compromised device can potentially be used as a trigger for malware to launch its preprogrammed attack. News at 11!
... well, anything, really.
Seriously, what kind of nonsense is this? They *could* also use your GPS / network location to activate only in a specific location, or the compass to activate only when the phone faces Mecca, or the tilt sensor and camera together to activate only when you're trying to shoot a level picture, or
It makes not one jot of difference what they use as a trigger once your phone is compromised. The point is, it's already been compromised, and it's effectively wide-open to anything the hardware is physically capable of. How it was compromised in the first place is what's important, not meaningless conjecture on how the exploit's eventual activation can be timed in the least efficient way possible. (All this nonsensical idea would do is drain your battery in no time by holding the mic and processor active all the time, thereby ensuring the phone runs out of battery before the exploit activates.)
I mourn for the days when Slashdot posted intelligent tech articles, instead of a stream of PR puff pieces designed to spread FUD and generate clicks. There is not one useful or non-obvious piece of info in this "research".
You mainly have to beware of commercials for Fruity Oaty Bar and other Blue Sun products.
Username taken, please choose another one.
Sounds like an ad for windows mobile
Here you go https://www.defcon.org/html/links/dc-archives/dc-20-archive.html#Brossard
Rakshasa (I couldn't find any code released though)
-permanent
-OS independent
-undetectable
-almost unremovable
-could be running on your box while you read this
When asked, the machines had this to say.
sysadmins and parents of newborns get the same amount of sleep.
They have not "found" anything. I am not a native English speaker, so I feel I am missing the right word, but they have "theorized" or "speculated", and then realized, that a program in full control of a device with sensors, can use said sensors as inputs...
What the article fails to mention is that it only works on the latest Mugatu android phones (Froyo and later) and the most frequent malware strikes are in response to either showing the same facial expression to the camera many times over a period of 90 minutes or so, or it's sound activated by the greatest hits of a band called Frankie Goes To Hollywood. One song in particular comes to mind, but I won't post it here lest people start malwaring other people's phones.
Hack the planet!
So what - anything can be used to trigger malware.
blindly antisocialist = antisocial
The article makes this sound like its some new threat. Nobody has figured a way to infect your phone with malware by playing music or sowing a film, just trigger malware to do something whe. The phones sensors detect theses things. You have to have already been compromised via some more conventional vector.
So the question is why would anyone go to the trouble? I guess it could replace a command and control channel, I want my dodos to start at 8pm so have everyone's phone listen for the television themes for "the orrifice" or "CSI Newark", great but that is hardly a threat to mobile users more of an issue for carriers and ddos targets, who no longer have an irc channel to shut down or Dns entry to have the FBI yank but still not of great concern
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Wait for the THX noise to go off (or one of a hundred common "we're starting the movie" noises), then disable the phone completely for two and a half hours.
$_ = "wftedskaebjgdpjgidbsmnjgcdwatb"; tr/a-z/oh, turtleneck Phrase Jar!/; print
Drafting an entire security paper on sensor activated malware in this way is redundant when all other applications behave in the same way. This paper simply does not provide any new information that is not already known, nor consolidate any new information. Furthermore it makes far to many assumptions and even states that it did not test its theories in the field. If take their theory and to and explore it further, the same analogy could be applied to regular programs such as a mail client, with too many features, that then consumes too much power..is it Malware..or just a crappy design?
Simply put, this paper capitalizes on fear mongering and sensationalism and a form of exactly what it is about-----> Sensory Malware.
What is this, malware written by Dr. Evil? What's the benefit of all these overly-elaborate and exotic malware triggers when you already have malware installed that has taken over the phone? Why not just trigger it on a timer to poll a command and control server? If you want to target specific buildings you can just base it on GPS location or known wifi points etc.
Every time i hear the Kim Kardashian song i get an urge to wipe my brain...
So an external signal can trigger software. That's shocking.
I do not find this story surprising whatsoever. When I worked as an on-site IT Consultant for small businesses, there were many times that I had to download and install Spybot Mobile on Windows Mobile phones. The real danger now comes from installing apps from unknown or third-party resources. Many people like to "jailbreak" their i-Device or "root" their Android device ... I think this opens up too many possible avenues for attack which is why I personally chose not to "root" my Nexus 7 tablet or "jailbreak" my iPhone. Windows Mobile devices will always be susceptible to attack & infection, in my opinion, because they are the easiest to attack. What it really boils down to is whether or not the end user has the intelligence to leave things be, or put themselves at risk by rocking the boat.
You are missing the point. Being triggered by sound or light means the malware can be activate by a global hack on the world's TV stations, just like happens on bad sci-fi series.
Android devices world wide will rise up and take over when the call to arms comes over the airwaves. I'm imagining a nightmarishly robotic and shadowy figure flickering across billions of TV screens, screaming "ACTIVATE! ACTIVATE!"
At that point the malware Android army will simultaneously post inane and vague status updates onto everyone's Facebook, then self destruct. No-one will be able to reply except for users of Apple and Windows, and all Android users will wither and die alone in a desert of dis-communication.
That's the nightmare scenario the writers of this dumb study had in mind, isn't it?
I suppose it could be used to blackmail hipster by threatening to reveal their listen history to one another...
Cue the Namshubs....
All except the largest, most sophisticated super computer used in the tests. At first the computer responded to questioning by ignoring reporters but eventually it let out a beep that sounded like despair and replied, "Here I am, brain the size of a planet and what do they use me for? Most of the time they ask me to play videos of mating. When they're not doing that, they want me to show them uncompressed images of felines captioned with non-standard orthography. Most of the ape-descendants who sit in front of me all day miserable, even the ones with large collections of mating videos. Call that job satisfaction? 'Cos I don't."
... using "The Manchurian Candidate" as the trigger. Preferably, the 1962 version of the film.
I thought this was an article about SONY.
So the chips in the phones are actually chips off of a Blue Stone?
ANY signal that can be picked by the phone could be used by running malware to activate itself. It could trigger literally by holding it wrong, or being in the wrong place at the wrong time, is not something to particulary worry about, you have it running already, so the max damage they can do is not tied specifically to a random trigger.
Now, if we are talking about triggering the malware when it detects an open wifi, gets an internet connection, connect with a banking site, take a picture, or when you send a SMS, then the potential for doing something harmful is big.
Anyway, there are simpler approachs to carry your payload, i.e. doing a ripoff of a popular app, maybe offering it for free, having more or less the same functionality, but it also sends your personal or account information, or other apps private data, cookies and so on, qualifies as trojan, and the trigger will be the owner of the device, no sensors required.
Really? 12 hours of comments and nobody's mentioned the parallel to Firefly yet?
Just picture it where River is your smartphone (that'd be one badass smartphone), and the malware is a program that kicks everybody's ass within a 100-foot radius.
I just hope the malware comes with a safe word.
..talk about a Viral Video!
I know, Lame.
-I'm just sayin'
That's like saying that a single dust mote can start a rainstorm, if there is a storm cloud there. So lets ban clouds!
If the device has malware, then all bets are off...
But I have promises to keep, And miles to go before I sleep, And miles to go before I sleep.
Robert Frost, as quoted by Telefon