Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
SpiderLabs Blog

Mobile Visability Limitation? There's an App for that.

Last July myself and Christian Papathanasiou presented a DEF CON 18 talk entitled "This is not the droid your looking for…". The topic of Android rootkits was widely picked up by the media, but the talk was designed around the security implication that exist when a piece a malware makes its way to a mobile device.

During our research we were successfully able to remotely obtain shell access on the device over the GSM network, read the users contacts, email, and SMS messages. Locating the device using its GPS coordinates and making a phantom phone call from the device where also demonstrated. As we noted other areas of functionality could include taking photos from the phones camera, recording from the phones mic and man-in-the-middle of apps and browser activity.

Last week, it was announced that over 50 apps in the Google Android Market were found to have malware imbedded in them. This malware is capable of data exfiltration off the victims phone. In the business world, this has major implications. How many CEO's of publically traded companies where running these apps? Maybe none, but if the malware had the capabilities that we demonstrated last summer, the implications are huge. Imagine a CEO sitting in business meetings with major clients, business partners, and even investors. The malware on that device could have the capabilities of tracking his/her physical location, and recordning the conversatons.

In the not so distant future, there will be confirmed reports of two companies are in possible merger talks, not because data "leaks" out of the corporate environment, but because there is a recording of the conversation and GPS data pinning the two CEO's at the same restaurant. Neither of the CEOs is knowling recording and disclosing these conversations, but one of their mobile phones has malware on it.

With all the news today around the weakness of the Android Market submission process, it is important to understand that this problem is just limited to the Android platform, but also impacts the iOS platform as well. Last fall SpiderLabs' Eric Monti demonstrated at ToorCon 12 that you could apply these same techniques to an iPhone and install a backdoor or other piece of malware. This is accomplished by using a technique used to jailbreak a device. In the case of malware, the jailbreak turned against the end user as an exploit to gain the attacker root privileges on the device. The window of exposure on "jailbreak-able" iOS devices is very large. Seemly hours after a new version of the iOS is released, a jailbreak is available, not to be "fixed" until the next release several months later. It is important to note that a "jailbreak" is equal to a root compromise. In Eric's research, he showed it as a silent drive-by installation requiring no user interaction.

The Android Market isn't the only mobile app shop where there is no security or content validation occurs. Many users jailbreak their iOS devices so they can install and run apps that have not been approved by Apple. Once a user has jailbroken their iOS devices, they can download apps from a marketplace called Cydia. What has recently happened in the Android Market can easily happen in Cydia, if it hasn't already. (Is anyone searching there?) This would allow a malicious developer to publish an application with malware, botnet or rootkit functionality to the jailbreak community. Given, I have run into CTO's of security vendors that have jailbroken iPhones, this threat isn't just limited to the tech hobbyist.

By design mobile devices place a strong layer of abstraction between the end user's interface and the underlying Operating Systems. This means that there could be a rootkit, backdoor or botnet running at the OS layer and the end user would have both no indication of its presence nor would they be able to detect its activity with the limited aid of the various security software applications on the market.

In the enterprise world, we see a lot of breaches that are detected by IT Security staff because of abnormal network traffic originating from an internal system. Also at times an end user reports stability or strange activity on his or her system and an investigation is started. In the mobile space, today, there are corporate executives roaming the planet with tablets and smart phones that have possibly never been directly connected to the corporate environment. How many organizations allow this, but have zero visibility into the activity and the status of such devices? How many employees have called into IT complaining of phone issues and an investigation has been opened into possible malware infestation? There isn't a lot of visability in the mobile space, today and as evidence of last week's news they are gearing up to make this a whole lot more interesting.

Latest SpiderLabs Blogs

Welcome to Adventures in Cybersecurity: The Defender Series

I’m happy to say I’m done chasing Microsoft certifications (AZ104/AZ500/SC100), and as a result, I’ve had the time to put some effort into a blog series that hopefully will entertain and inform you...

Read More

Trustwave SpiderLabs: Insights and Solutions to Defend Educational Institutions Against Cyber Threats

Security teams responsible for defending educational institutions at higher education and primary school levels often find themselves facing harsh lessons from threat actors who exploit the numerous...

Read More

Breakdown of Tycoon Phishing-as-a-Service System

Just weeks after Trustwave SpiderLabs reported on the Greatness phishing-as-a-service (PaaS) framework, SpiderLabs’ Email Security team is tracking another PaaS called Tycoon Group.

Read More