5 ms·

> Among the malware was a malicious spyware, including a remote access tool called “Droidjack,” that allows attackers to silently control a mobile device. When

> Among the malware was a malicious spyware, including a remote access tool called “Droidjack,” that allows attackers to silently control a mobile device. When Droidjack is installed, a remote user can turn on the microphone and camera, remove files, read encrypted messages, and send spoofed instant messages and emails. How is this even possible? I have always considered phones to be more secure then PC due to additional security measures (such as sandboxing for every app as well as more fine granted permission systems). I'm aware that malware can be installed on a phone but I always though I was required to explicitly allow that (at least on android) and I thought it was impossible on iOS without jail breaking. Or does this app use some zero days, that have been discovered years ago but have not been patched because of androids broken update policy? More information on how this works would be highly appreciated.

fhood 10y ago
I don't know about droidjack specifically, but your phone is not at all secure, particularly for android. All it takes is a little bit of bad C code to cause an overflow of some sort. Combine that with widely available unencrypted firmware and you have a real vulnerability.
- bitmapbrother 10y ago
  Are you implying that you could create an Android exploit with "little bit of bad C code"? If so, I'm not sure you understand how exploits work and the work required to get around all of the mitigations in place.
  - girvo 10y ago
    Depends. Once you get root--and as others have noted above, that's far easier than it should be on most handsets--all bets are off really.
Mahn 10y ago
Most likely they are exploiting a security hole to quickly gain root access. Over the years a number of "one-click" root exploits have appeared for Android, so it's not unthinkable that they are rooting on the fly. Besides, most Android phones aren't particularly up-to-date, so in a lot of cases it's not like they would even need an undisclosed zero day exploit.
drzaiusapelord 10y ago
Droidjack can do the following according to Symantec: * No root access required * Bind the DroidJack server APK with any other game or app Sounds like its delivered using an 'innocent' game or app in the Play store. Convincing someone to install a random Play app isn't that tough. Send them a powerpoint and leave a link to an 'innocent' Powerpoint Viewer. Voila! You have Droidjack. If social engineering doesn't work you can bribe or compel someone close to the person you're monitoring to borrow his/her phone and have them install the infected Play store item. Or get pulled over by a cop or intelligence agent, who takes your phone for one moment and installs it behind your back. Non-technical people may not even think this suspicious. http://www.symantec.com/connect/blogs/droidjack-rat-tale-how-budding-entrepreneurism-can-turn-cybercrime http://www.symantec.com/connect/blogs/droidjack-rat-tale-how...
sievebrain 10y ago
It is explicitly required, so either DroidJack has a way around that, or (more likely) there's an obfuscated version of it in the Play Store which can then be told to install the app via code that remotely controls the browser (or steals cookies).
fweespeech 10y ago
> How is this even possible? I have always considered phones to be more secure then PC due to additional security measures (such as sandboxing for every app as well as more fine granted permission systems). Zero Day Exploits are frequently unpatched unless you have a Nexus phone for Android or an iOS device. :/ and/or https://www.usenix.org/system/files/conference/woot12/woot12-final24.pdf https://www.usenix.org/system/files/conference/woot12/woot12... > We have demonstrated that memory corruptions in baseband firmwares exist and can be practically exploited. These security problems are to be taken seriously: practical exploitation of these completely compromises the integrity of the attacked handset. Merely coming into the proximity of a malicious base station is is sufficient to take over any vulnerable handset – no user interaction is required by the bugs we have outlined above. The cost of exploitation is low enough to make these attacks a reality even for attackers with a limited budget: for the price of a mid-range laptop – USD 1500 – an attacker can buy the hardware to operate a malicious GSM cell with OpenBTS. User interaction isn't even really required, just a rogue base station + a vulnerable baseband (and those are updated even less frequently, iirc, Apple and the Nexus line are the only ones that update those) https://developer.android.com/about/dashboards/index.html https://developer.android.com/about/dashboards/index.html Only 13.3% are up to date :/
at-fates-hands 10y ago
>> How is this even possible? As far as I can tell, you can package this software with any legitimate game or application. Mix in some social engineering and spear phishing, and it wouldn't take much effort to get this installed either on a targeted victim, or a large number of random victims.

fhood 10y ago

I don't know about droidjack specifically, but your phone is not at all secure, particularly for android. All it takes is a little bit of bad C code to cause an overflow of some sort. Combine that with widely available unencrypted firmware and you have a real vulnerability.

bitmapbrother 10y ago
Are you implying that you could create an Android exploit with "little bit of bad C code"? If so, I'm not sure you understand how exploits work and the work required to get around all of the mitigations in place.
- girvo 10y ago
  Depends. Once you get root--and as others have noted above, that's far easier than it should be on most handsets--all bets are off really.

Mahn 10y ago

Most likely they are exploiting a security hole to quickly gain root access. Over the years a number of "one-click" root exploits have appeared for Android, so it's not unthinkable that they are rooting on the fly. Besides, most Android phones aren't particularly up-to-date, so in a lot of cases it's not like they would even need an undisclosed zero day exploit.

drzaiusapelord 10y ago

Droidjack can do the following according to Symantec: * No root access required * Bind the DroidJack server APK with any other game or app Sounds like its delivered using an 'innocent' game or app in the Play store. Convincing someone to install a random Play app isn't that tough. Send them a powerpoint and leave a link to an 'innocent' Powerpoint Viewer. Voila! You have Droidjack. If social engineering doesn't work you can bribe or compel someone close to the person you're monitoring to borrow his/her phone and have them install the infected Play store item. Or get pulled over by a cop or intelligence agent, who takes your phone for one moment and installs it behind your back. Non-technical people may not even think this suspicious. http://www.symantec.com/connect/blogs/droidjack-rat-tale-how-budding-entrepreneurism-can-turn-cybercrime http://www.symantec.com/connect/blogs/droidjack-rat-tale-how...

sievebrain 10y ago

It is explicitly required, so either DroidJack has a way around that, or (more likely) there's an obfuscated version of it in the Play Store which can then be told to install the app via code that remotely controls the browser (or steals cookies).

fweespeech 10y ago

> How is this even possible? I have always considered phones to be more secure then PC due to additional security measures (such as sandboxing for every app as well as more fine granted permission systems). Zero Day Exploits are frequently unpatched unless you have a Nexus phone for Android or an iOS device. :/ and/or https://www.usenix.org/system/files/conference/woot12/woot12-final24.pdf https://www.usenix.org/system/files/conference/woot12/woot12... > We have demonstrated that memory corruptions in baseband firmwares exist and can be practically exploited. These security problems are to be taken seriously: practical exploitation of these completely compromises the integrity of the attacked handset. Merely coming into the proximity of a malicious base station is is sufficient to take over any vulnerable handset – no user interaction is required by the bugs we have outlined above. The cost of exploitation is low enough to make these attacks a reality even for attackers with a limited budget: for the price of a mid-range laptop – USD 1500 – an attacker can buy the hardware to operate a malicious GSM cell with OpenBTS. User interaction isn't even really required, just a rogue base station + a vulnerable baseband (and those are updated even less frequently, iirc, Apple and the Nexus line are the only ones that update those) https://developer.android.com/about/dashboards/index.html https://developer.android.com/about/dashboards/index.html Only 13.3% are up to date :/

at-fates-hands 10y ago

>> How is this even possible? As far as I can tell, you can package this software with any legitimate game or application. Mix in some social engineering and spear phishing, and it wouldn't take much effort to get this installed either on a targeted victim, or a large number of random victims.