Slashdot Mirror
Hacking Team's RCS Android May Be the Most Sophisticated Android Malware Ever Exposed
An anonymous reader writes: As each day passes and researchers find more and more source code in the huge Hacking Team data dump, it becomes more clear what the company's customers could do with the spyware. After having revealed one of the ways that the company used to deliver its spyware on Android devices, Trend Micro researchers have analyzed the code of the actual spyware: RCS Android (Remote Control System Android). Unsurprisingly, it can do so many things and spy on so many levels that they consider it the most sophisticated Android malware ever exposed. The software can, among other things, gather device information, capture screenshots and photos, record speech by using the devices' microphone, capture voice calls, record location, capture Wi-Fi and online account passwords, collect contacts and decode messages from IM accounts, as well as collect SMS, MMS, and Gmail messages.
Hacking Team says it sold its surveillance and intrusion software strictly within the law.
Sold malware within the limits of the law? Whose law? Not my law. By my law a man looks another man in the eye before stabbing him in the heart, and doesn't sneak up on him to stab him in the back.
Awesome. So when's the patch coming out?
Something that runs as root/administrator has access to all that data, no surprise. Maybe you mean the fact that somebody programmed a way to retrieve and view it all as the accomplishment, all that took was time for somebody to do it all.
>> if security and privacy are a concern, maybe iPhone isn't really such a bad option
Dude, is Google down today? http://lmgtfy.com/?q=iphone+ma...
Then look up WireLurker. Then MASQUE-D. And if you jailbreak a phone, pretty much all bets are off.
Killing Jews was strictly within the law of Nazi Germany.
What is wrong is wrong. Within the law or outside of it, there are certain things that make you an asshole when you do it.
Supporting oppressive regimes is such a thing. Yes, it's legal to deal with them. Yes, it's legal to sell them your shit. Yes, you're still an asshole for doing so. A legal asshole if you want to, but at the end of the day, you're still just full of shit and nobody wants to touch you.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
"The spyware is delivered either via the aforementioned app, or via an SMS or email that contain a specially crafted URL that will trigger exploits for several vulnerabilities in the default browsers of Android versions 4.0 Ice Cream Sandwich to 4.3 Jelly Bean."
You are fucked. Either root your own device and upgrade to a new version/custom rom or just live with the fact that you will always stay vulnerable, at least until your next phone purchase.
Thank the phone carries going forward for their forward thinking.
Hey, if there's any angry hackers out there, will someone please ruin these assholes lives?
Because if anybody deserves to be fucked with by the internet, it's these clowns.
kthanksbye
Lost at C:>. Found at C.
Sounds like a lot of different Android apps. The Facebook app can do most of the same things, as can Chrome, and so on....
Is there a tool to check and see if you've been infected?
Just another shitty day on a shitty phone OS
Jailbroken iDevices are totally irrelevant. There have been zero exploits on non-JB devices that are widespread.
Also, Android isn't that insecure. A rooted Android device is just as secure as an unrooted one, assuming the user doesn't click "allow" on the su dialog. In fact. the latest su app won't allow apps to ask for root access unless the install permissions have PERMISSION_SUPERUSER present in the app manifest.
However, Android does have a permission model that is all or nothing, where a fleshlight app can ask for everything under the sun and there is no "allow, but not with those permissions" available.
Well, unless one downgrades to 4.x and uses XPrivacy, which solved the job quite well, as good, if not better than PMP on Cydia.
Check out App Ops... granular permissions (kinda) on Android.
Walled garden no bugs or exploits. It only means now you're even more dependent on a company to fix the exploits and bugs because it's much harder to find workarounds or fix them yourself.
The stock browser is a primary avenue of exploit for this malware. Stock lives in /system where it is installed read-only.
This was a colossally foolish thing to do. Browser libraries, executables, and sundry components MUST retain the ability to receive patches.
LD_LIBRARY_PATH should point to /data/lib, then resolve to /system/lib only if an override library is not installed, allowing update capability for stock webkit.
A bunch of soulless, fascist fucks that have proven that they deserve to live in Guantanamo Bay as honored guests, like the rest of the terrorists residing there.
This is great for framing people you do not like. Hack their phone, upload some child porn to the device, then phone in an anonymous tip that you saw the victim looking at questionable content on his phone. Leave the back door around long enough to help unlock the device if the victim decides to lawyer up and make it difficult for the cops to get in.
I know there is for the PC, I'd like to see if I can catch some bitch trying to hack my phone. Thanks.
Never have I been so happy to have an old, old Nokia phone that can't load apps, doesn't run on iOS or Android, and is pretty much immune to all of this fancy hacker-bullshit. Yeah, maybe I'm a throwback, but at least I'm not worried about having my phone cornholed by some crap-ass company or hacker.
:)
No, I can't watch movies on my phone (that's what I have a TV for, hello?) and no I can't find out the temperature on Mars, but guess what? I don't want to.
I want to 1) make calls, 2) take calls, and 3) maybe take a picture now and then. Trying to hack my phone would be an exercise in frustration, lol.
Just cruising through this digital world at 33 1/3 rpm...
A dedicated, full time, paid set of software (and, presumably) hardware professionals with tens (or hundreds) of millions in revenue/funding with no fear of prosecution have managed to create effective software which uses exactly the same features that are available to the OS and app developers to collect data and phone home on the sly, while avoiding detection by people who are - mostly - entirely ignorant of the underlying system.
This is funded by the same people who can press a button and put a thousand pounds of high explosives, literally, through the front door of a building a thousand miles away in under 120 minutes, or 500lbs from 300 miles away in under 10 minutes.
It would be a story if they couldn't. (actually, it wouldn't - we'd call them typical incompetent government contractors).
Is it just my observation, or are there way too many stupid people in the world?
Walled garden makes no difference, as this apparently exploits old Android bugs to install itself.
The big difference is that Apple continues to support old devices with new versions of the operating system until the hardware becomes too outdated to run it. Android devices are lucky if they get two upgrades before the carrier or manufacturer declares them done.
And, yes, that's one reason I'm expecting to dump Android for Apple when Google stop supporting my Nexus tablet.
Apple's user base is pretty large. And there have been multiple malwares created for iOS, for example WireLurker.
;)
How do you think you perform the jailbreak? Oh right you use an exploit. I remember the iPhone 3G had a website called let me jailbreak that for you. As for vl permissions, there is appops in android but you'll need to root to use it. At least 'till Android M is released.
Apple's user base is pretty large. And there have been multiple malwares created for iOS, for example WireLurker.
Which apparently requires you to download a trojan onto your OSX machine, then plug your iPhone into it. Not exactly quite so easy as auto-installing when you browse a URL with a vulnerable version of Android because your phone carrier won't let you upgrade it.
I know this is off topic here, but my phone gets it's Windows 10 upgrade sometime next week.
However, Android does have a permission model that is all or nothing, where a fleshlight app can ask for everything under the sun and there is no "allow, but not with those permissions" available.
This is changing in Android M
Walled garden makes no difference, as this apparently exploits old Android bugs to install itself.
The big difference is that Apple continues to support old devices with new versions of the operating system until the hardware becomes too outdated to run it. Android devices are lucky if they get two upgrades before the carrier or manufacturer declares them done.
And, yes, that's one reason I'm expecting to dump Android for Apple when Google stop supporting my Nexus tablet.
Apple does stop supporting. My (no longer used) iPad is stuck on iOS 5.x.
Personally I believe device manufactures should be held accountable for not pushing OTA updates to patch security exploits. At least for x number of years after releasing a device or Google stops patches for that version of Android. This is one reason I moved to a Nexus 6 from a Samsung Note 2. I was considering a Note 4 but I hate always being 2 versions behind in Android versions. Samsung claims they are working on 5.0.x for the Note 2 but if and when they push it out, Android M (5.2?) will be out. Sure I was already running 5.1 because I root. That's not the point. The point is that these companies being slow at pushing out OS updates is whats keeping so many people's devices at risk.
Why call it secure?
Ssl is broken, most if naught all security measures that were created many years ago are broken.
These mechanisms were created many years ago.. MANY!!! As a result, tech has caught up now and all of these methods are crap..
I find it funny that many people try to sweep it under the "rug" but we are here now..
What ya going to to about it?
where a fleshlight app
Woah! They have an app? Is there an external attachment too?
>> if security and privacy are a concern, maybe iPhone isn't really such a bad option
Dude, is Google down today? http://lmgtfy.com/?q=iphone+ma...
Then look up WireLurker. Then MASQUE-D. And if you jailbreak a phone, pretty much all bets are off.
WireLurker looks to be pretty nasty, that's for sure. But it's also only on a GreyWare "App Store", NOT available through legit channels.
And MASQUE-D is such a threat (NOT!) that I had to try two different search terms to even FIND a reference on Google. Plus, it again is a Trojan, that has to entice the user to install it from a non-legitimate "App" site.
And as far as JailBreaking your iOS device, you get what you deserve, period.
So, thanks for proving the point that the "Walled Garden" actually WORKS. If you want to spend the extra effort to step outside into the Methane-Gas atmosphere, then don't complain when you start choking...
Next!
fleshlight app
What does that do, exactly?
However, Android does have a permission model that is all or nothing, where a fleshlight app can ask for everything under the sun and there is no "allow, but not with those permissions" available.
This is changing in Android M
Too bad that pretty much EVERYONE who owns an Android device currently will have to:
1. Wait a YEAR while all the Carriers re-infect it with THEIR Malware, er, Extra Features.
2. THROW AWAY their Current Android Device, the BUY ONE WITH Android "M".
There was the exploit where you hold the power button while performing another task and it bypassed the lock screen. Apple is not immune to bugs, no matter what you think.
Walled garden no bugs or exploits. It only means now you're even more dependent on a company to fix the exploits and bugs because it's much harder to find workarounds or fix them yourself.
And Android Users can?
Apple does stop supporting. My (no longer used) iPad is stuck on iOS 5.x.
He never said they don't stop supporting. Only that they do so ONLY when the Hardware simply makes it impractical.
You have a first-generation iPad. Know how I know that? Because EVERY other version of the iPad (including my iPad 2nd gen) IS still supported (haven't checked as to whether that is true for iOS 9; but so far, it has been supported). In fact, Apple recently released a "point-release" for iOS8 that, among other things, was specifically designed to improve performance on iPad 2.
NOBODY in the Android-universe does that, with the possible exception of Google with Nexus. And they do that only because it is their Reference Platform for Android.
You should really look up "fleshlight." I was not aware that there was an app for that.
"Hacking Team used fake app hosted on Google Play to install its spyware on Android devices"
For a minute there I thought Hacking Team/slashdot were going to dazzle me with their hacking-foo. How does remotely installing and running an app - and achieving root on a device - equate to tricking the user into downloading and installing a fake app?
Who do they think they are, the NSA? We'll show them what exceptional hackers are and bomb them off the face of the earth.
where a fleshlight app
Woah! They have an app? Is there an external attachment too?
Somebody mod that post sexy - Zapp Brannian
This is why I got the Nexus 6... I got sick of waiting.
XPosed framework works fine for me (YMMV) on my LG G2 running 5.0.2. Anecdotal, I know...
In general I think you're correct. Most people are pretty dumb and likely better off in the walled garden so they can't hurt themselves. Similarly, dumb people are better off with a foam hammer than a real hammer, even if it's less useful at least they can't nail themselves to their toilet.
In general I think you're correct. Most people are pretty dumb and likely better off in the walled garden so they can't hurt themselves. Similarly, dumb people are better off with a foam hammer than a real hammer, even if it's less useful at least they can't nail themselves to their toilet.
See? There you go, blaming the user. Typical Slashtard.
There is a BIG difference between being "dumb" and being "ignorant".
If I sat you down in the control room of a jet fighter, or a helicopter, I would bet that (assuming you aren't skilled in any of those) you wouldn't be able to successfully land any of them. Why? Because you simply haven't had to learn those skills to navigate your particular slice of the universe. Does that make you "dumb"?
Not everyone is a computer expert. And that is EXACTLY what it takes to determine which (if any) of a set of permissions an app might need, if you are IGNORANT of the rather dire consequences of granting just ONE of the wrong permissions.