7 ms·
Android Backdoor GhostCtrl Can Silently Record Your Audio, Video, and More
- ouid 9y agoall I see is dwarf fortress
- SCdF 9y ago> The malware masquerades as a legitimate or popular app that uses the names App, MMS, whatsapp, and even Pokemon GO. OK, so the attack vector here is installing dodgy stuff off the Play store? Or not the play store but from another source, such as an ad?
- michaelbuckbee 9y agoAll of the above, it's a payload that is part of multiple different attacks.
- ninju 9y agoI believe it's only from 'third party' app stores..The official Google Play store already scans applications for such malicious content.
- on_and_off 9y agoEven random apks are analyzed by the same service that is used by the play store. It is still more dangerous, but known signatures are detected.
- StavrosK 9y ago(How) does this bypass the permissions system?
- kbart 9y agoIt was (still is?) a common practice to grant all permissions when installing an app from Google Play. Most people don't even look at the "annoying" popup that lists permissions to be granted and just press "accept" without ever reading it.
- sspiff 9y agoOn recent Android versions, permissions are prompted one by one, whenever an API that needs that permission is first called. Each individual permission is prompted for and can individually be denies. I personally consider this an improvement, though I realize many (probably most) users will just click through anyway.
- JoshTriplett 9y agoOnly for updated apps. Apps written for an older Android API still demand every permission they want at install time.
- pjmlp 9y agoOn consumer shops Android 4.4 and 5.1 devices are still the ones being sold on the 100€ price range. The permissions system was introduced on 6.0.
- JadeNB 9y agoI just got a Samsung G550T, which is just north of your stated price range (currently $120 on Amazon https://www.amazon.com/Samsung-T-Mobile-Unlocked-Galaxy-Smartphone/dp/B06XS98LMS https://www.amazon.com/Samsung-T-Mobile-Unlocked-Galaxy-Smar...) but does have Marshmallow.
- JadeNB 9y agoThere's also the Nextbit Robin (https://www.amazon.com/gp/product/B01D9LVCAI https://www.amazon.com/gp/product/B01D9LVCAI) for just a hair more (currently $129 on Amazon). The product description says it's got Marshmallow, but, according to https://www.amazon.com/forum/-/Tx16RURIU0E0P5O https://www.amazon.com/forum/-/Tx16RURIU0E0P5O , it's actually been upgraded to Nougat.
- sandralisa667 9y agoThis site is a great comfort to me after losing my job [Check Details Here⇒> http://cutt.us/7N2sG http://cutt.us/7N2sG ]. I have sought for a new job without success, until a friend suggested online jobs for me, and after making some research I stumbled upon this site and since then I no longer feel the loss of my former job. I even earn more than I do before. Show less
- breakingcups 9y agoWhat's so special about this one compared to the other well-known trojans (like omnirat, the RAT this one is based on)?
- TACIXAT 9y agoIt literally is Omnirat. From the article: >GhostCtrl is also actually a variant (or at least based on) of the commercially sold, multiplatform OmniRAT that made headlines in November 2015.
- sleepychu 9y agoSo is the experience: "Hacked Up Pokemon Go needs thse permissions" (all of them) (deny, allow), user has been trained that if they deny a permission the app won't work so they click allow?
- ClassyJacket 9y agoI would assume it simply doesn't use the Android 6 permission system, so the user gets no option to deny.
- mrkrabo 9y agoObservation: I suppose it's some kind of meme in this industry that in this kind of posts they take screenshots from MS-DOS editors opening the malware.
- grecy 9y agoJust like young men sneaking around and wearing black face masks in stories about "hacking"
- teniutza 9y agoYou mean this guy https://www.troyhunt.com/is-this-hooded-cyber-bandit-the-webs-most-prolific-hacker https://www.troyhunt.com/is-this-hooded-cyber-bandit-the-web... ?
- _ao789 9y agoBest article ever :D
- grecy 9y agoI was think worse, like this: http://cdn.wccftech.com/wp-content/uploads/2017/03/icloud-scam.jpg http://cdn.wccftech.com/wp-content/uploads/2017/03/icloud-sc... http://www.jordantimes.com/sites/default/files/styles/news_inner/public/hacking.jpg?itok=4CuL2dZf http://www.jordantimes.com/sites/default/files/styles/news_i... etc Usually show men in black clothes trying to climb in windows, etc.
- debatem1 9y agoWhy is this being called a backdoor? Is there any indication that that's what it is? Except for the headline, the only claim even remotely as serious made in the article is that it can root some devices, and figuring out which ones is left as an exercise for the reader...
- fulafel 9y agoC&C servers, evasion techniques like masquerading as system package, bootstrapping the encrypted payload malware with a wrapper APK, ransomware features, piles of exfiltrated informaiton, intercepting calls and text messages, ransomware functionality... it's like a crook with a record the size of a phonebook.
- captainlego 9y agoBut, unless I somehow missed a big point, doesn't it start with the user installing a malicious package?
- fulafel 9y agoNot knowingly. Sounds like there is a phony app as a phishing style infection vector: "The malware masquerades as a legitimate or popular app that uses the names App, MMS, whatsapp, and even Pokemon GO. When the app is launched, it base64-decodes a string from the resource file and writes it down, which is actually the malicious Android Application Package (APK)." The user has a legitimate expectation that the app sandbox containment provided by the OS works and nothing bad should happen if s/he tries out the aforementioned apps. This type of malware are commonly called backdoors, see eg. http://www.virusradar.com/en/glossary/backdoor http://www.virusradar.com/en/glossary/backdoor
- dahart 9y agoThat link says right at the top, "The difference between this type of malware and a legitimate application with similar functionality is that the installation is done without the user’s knowledge." I agree with @debatem1, this is not what "backdoor" commonly means, phishing does not count as "without the user's knowledge". Phishing is a trick to get in the front door.
- tym0 9y agoTitle is misleading, it makes it sound like the backdoor is in the Android software while this is just malware.
- Joeri 9y agoThe point is that android makes it possible. You don't have these things on iOS because apple doesn't allow them, where google does.
- Ajedi32 9y agoAny platform which allows users to install arbitrary software of their own choosing "allows" this. GNU/Linux for example, also allows this. As do Mac, Windows, and jailbroken iOS.
- Joeri 9y agoThis is the choice everyone makes: safety in a walled garden, or freedom outside of it. For my phone I much prefer the safety trade-off, so I would never choose android, but for my work laptop I wouldn't want to be locked down in a similar way.
- SippinLean 9y agoHow quickly you forget the malware that was served by the iOS App Store https://sputniknews.com/science/201509211027280404/ https://sputniknews.com/science/201509211027280404/
- willstrafach 9y agoThe link does not describe malware served by the iOS App Store at all. XcodeGhost was indeed worrisome as it is unwanted code, but it did not actually perform malicious actions beyond those found in a standard analytics library included by many developers in their apps.
- ericfrederich 9y agoCool... can I use it to have a decent app to record a phone call? All other existing solutions require you to turn on speaker phone.
- rkeene2 9y agoTry ACR by NLL, it has worked great for me. Though if you change inputs in the middle of the call it keeps recording the wrong path and you end up with only half the conversation.
- ericmo 9y agoIDK how NLL's ACR works, but Android API doesn't expose audio output devices because it could lead to piracy issues, such as recording whatever is playing on Spotify. I don't think there's a way to bypass that, and if there were it would probably be banned from Google Play Store.
- bullen 9y agoTrend micro pipes all your HTTP data through their proxies. Avoid this company at all costs so that they can become bankrupt.