11 ms·

What happens when your phone is spying on you

184 points by sizzle 4y ago

hiurwbkjlfjo 4y ago
[dead]
blakesterz 4y ago
Maybe I missed it, but I didn't see a link to the actual paper, I think this is it from the conference site: https://petsymposium.org/popets/2023/popets-2023-0013.php https://petsymposium.org/popets/2023/popets-2023-0013.php
- sizzle 4y ago
  Thanks for linking to the paper
victor106 4y ago
The title needs to be updated to say “Android”
- sizzle 4y ago
  There are surreptitious ways to achieving covert monitoring on iOS. To say this applies to Android only is simply untrue. You can do things via MDM on iOS for example and install spyware “monitoring” apps/set OS level permissions that are invisible to non tech saavy users. Also if you have access to the device and the iCloud password/device pin (e.g. abusive partner scenario, etc.) then non tech saavy people don’t stand a chance against being secretly monitored.
  - CharlesW 4y ago
    > To say this applies to Android only is simply untrue. To be fair, this particular issue — the creative abuse of Android APIs by "stalkerware" apps — applies to Android only. Also, MDMs on iPhones can't do the kinds of covert monitoring that this paper discusses. They can't access texts, emails, photos or other personal messages or data within apps on a device.
    - paulmd 4y ago
      well, thanks to the EU, it's going to apply to Apple real soon too. This is one of the things app store review and fully enforcable permissioning prevents (prevented). https://9to5mac.com/2022/12/13/apple-alternative-app-stores-iphone/ https://9to5mac.com/2022/12/13/apple-alternative-app-stores-... So much for the "app store is like 1984" marketing spin that Epic put out lol. Now you have the freedom to have spyware installed on your phone... which is what I and many others have been saying all along. Not just abusive spouses but Facebook and others will be all over this. https://www.youtube.com/watch?v=euiSHuaw6Q4 https://www.youtube.com/watch?v=euiSHuaw6Q4 As I said previously... Facebook and others already have this sort of spyware ready to go, because they were already using their developer credentials to get users to sideload it for data mining. Now it won't be optional/"we'll give you a gift card", it'll just be mandatory if you want to use Facebook on a ios device. Sorry this device is not supported via web, please install the native app. https://arstechnica.com/gadgets/2019/01/facebook-and-google-offered-gift-cards-for-root-level-access-to-ios-users-data/ https://arstechnica.com/gadgets/2019/01/facebook-and-google-...
    - sizzle 4y ago
      honestly all they need to monitor people is built into Apple products out of the box. Sync a dummy iCloud enabled AppleID, and clear all the prompts and emails that the device was added to the account. You now have access to everything via iCloud and FindMy app for location tracking. You can even sign into another device and have real-time iMessage and other private data without installing any spyware apps. I will admit this is outside the scope of the paper, but arguably harder to mitigate if you are not ever checking your iCloud settings.
  - baxtr 4y ago
    I don’t think it’s black and white. But the two systems are pretty much on opposite end of the spectrum.
  - cyberbanjo 4y ago
    TFA: We focus on Android-based spyware because most of the mobile spyware market appears to be focused there. Since curated app stores like Google Play do not permit the sale of such apps, in practice they must be side-loaded off-store, a process that Apple does not support. As a result, consumer mobile spyware only operates on “rooted” iPhones. Rooting an iPhone can be a technically involved operation (one popular guide to jailbreaking the iPhone involves 41 distinct steps [17]) and one that can take significant time to complete — both requirements at odds with the broad, non-technical customer base such apps are marketed to. We also focus on leading spyware apps as they are the apps that more people are exposed to and they are more likely to be innovative (new features could potentially bring them more customers).
    - scarface74 4y ago
      And you think the Google Play Store (or the App Store) for that matter could even know what apps are doing? With iOS, the protection comes from its tighter permissions model and sandboxing
      - kramerger 4y ago
        Are those two really significantly different in sandboxing and permission model? Should also point out that neither app store is perfect and both have let malicious app slip through. Thanks to the Epic lawsuit we also know that they have tried to hide major incidents ( as in 500M installs of potential malware) from consumers.
        scarface74 4y ago
        Yes, there is no API on iOS that allows most of the things listed in the article that apps can use even it tried to use non documented APIs. > After installation, they covertly record the victim’s device activities — including any text messages, emails, photos, or voice calls — and allow abusers to remotely review this information through a web portal And the “malware” that was installed was because people were using hacked XCode versions that didn’t come from Apple and they still didn’t escape the sandbox.
  - scarface74 4y ago
    Even with someone’s iCloud password and physical access to your phone, a normal app can’t access your phone logs, your camera while running in the background, record your screen etc, even with an MDM.
  - bartvk 4y ago
    > You can do things via MDM on iOS for example and install spyware “monitoring” apps Can you name one?
    - sizzle 4y ago
      I mentioned a different scenario involving iCloud, please see my comment above.
  - randomwebuser 4y ago
    Thank you for saying this. I agree with OP concerning the article. I work in finance and if people knew just how clueless even we are when it comes to devices being compromised they would never use an app or website for banking again. Even if we can tell it wasn’t the account holder it’s extremely hard to do much more than that. No one knows what to tell the poor person either. I take a hit and get in trouble for my hour call giving instructions but rather that than see someone suffer. Also bad for people with stalkers/abusive partners. I don’t know why everyone says it’s so hard to compromise a device/number (either platform) when it’s not. Or maybe I’m just in a position where I see it more often and overall it is hard? My day job minimum of 2 a day, confirmed not counting otherwise. Volunteer work, its not as frequent but also don’t deal with same volume of people. It is creepier though and no one knows what to do. One case working w a big agency as it involves a high dollar amount and is ongoing and THEY can’t seem to give advice that works either. Person at this point went to a flip phone. Reset the phone? Didn’t work. Abandon all accounts, reset phone, cool. Didn’t work. K now all of the above and dump the number, and/or replace entire phone, latter usually works but not always. Sorry this is long here is my point in commenting. I wish someone with knowledge would take the time to do a solid write up for people with zero tech knowledge not just how to protect themselves but how to determine if/how they are compromised, log proof if possible (court etc) get rid of it and move forward safely, or as safe as possible for both android and IOS, a comprehensive write up. They would be a super hero. Literally help countless. It would help people like the 83 y/o grandma who got cleaned out THREE TIMES and cried to me begging for help on how to stop it, the women whose abusive exes show up at shelters because they have accessed sms or location despite the women using precautions given to them as the precautions are not up to date with what’s possible. Forgive me, it gets to me some of the most vulnerable people are dealing with this at an alarming rate and the people they are told to get help from genuinely don’t know what to do, while I know some it’s not enough to truly be of help say if someone has a well versed ex determined to hunt them down. These people could care less about the Gov knowing all, they just want to be safe.
- photochemsyn 4y ago
  This quote in the article seems overly optimistic: > "While Google does not permit the sale of such apps on its Google Play app store, Android phones commonly allow such invasive apps to be downloaded separately via the Web. The iPhone, in comparison, does not allow such “side loading” and thus consumer spyware apps on this platform tend to be far more limited and less invasive in capabilities." Recommended: https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/ https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents... > "After confirming forensic traces of Pegasus on Nour’s iPhone, we identified the presence of additional spyware, which we attribute with high confidence to Cytrox. We further conclude with high confidence that it is unrelated to Pegasus spyware."
  - CharlesW 4y ago
    Once an iPhone is jailbroken, yes — anything goes. The paper describes an Android attack that just requires an app install that "[does] not require specialized technical know-how to deploy or operate".
    - paulmd 4y ago
      or more generally when you're going up against nation-state level actors, such as in your link. In that case yeah all bets are off, NSA and Mossad (and places commercializing technology developed for them) are gonna get in your phone if they want to. But this is still qualitatively different from android where the threat model is "connect USB cable and run ADB command", if even that much.
      - hot_gril 4y ago
        At the end of the day, tech-illiterate people are gonna get spyware onto their Android phones much more easily. If a website tells them to download some app directly and ignore any warnings about it being untrusted, they'll do it.
mikece 4y ago
"When your phone is spying on you"??? The title makes it sound like this isn't a 24x7x365 concern when it very much is!
zw123456 4y ago
Something happened to me the other day, I started drafting a text using the regular text messaging app on my android phone, I was sending it to a friend, but I got distracted by a call and never sent the text. Later I went to finish it and send it but he had gone in and put some smart-alec comment in the text of the message I was drafting. I was shocked. He refuses to tell me how he did it. I went through all the settings, scans permissions and so on. He says he can't do it now but still refuses to tell me how he did it. Scary. I wish I could find out what it was he did. Any HN'ers have any ideas?
- jtbayly 4y ago
  Were the two of you ever in physical proximity?
  - zw123456 4y ago
    Yeah, I replied in the thread earlier, I suspect he saw me put my pin in. But at the time it happened he was on the other side of town.
    - sizzle 4y ago
      Change your pin and see if he added his fingerprint or Face ID to unlock then dump them for being a privacy invading friend
- robin_reala 4y ago
  Hate to say it, but he doesn’t sound like much of a friend if he’s owned your phone and refuses to elaborate on how.
  - BiteCode_dev 4y ago
    Sounds like a good joke to be of either side on to me. No harm done.
    - jabroni_salad 4y ago
charcircuit 4y ago
>They collect a range of sensitive information such as location, texts and calls, as well as audio and video. This sentence ruins the credibility of the article because Android doesn't let you do this. The camera, microphone, can only be used when an app is in the foreground. For location data being tracked in the background it will have a persistent notification telling the user that an app has your location. For an app to read your call log or SMSs it has to be set as the phone's default phone or SMS app. This combined with androids reminders to review the permissions for apps that have dangerous permissions and Play Protect which can detect and remove spyware this article is giving Android much less credit than it deserves.
- b112 4y ago
  Doesn't overlay do the same?
  - charcircuit 4y ago
    Do you mean having a persistent notification? Yes, it does.
- uoaei 4y ago
  > The camera, microphone, can only be used when an app is in the foreground. This is not true. This may be partially true on the latest Android, but you can still set permissions to use e.g. GPS all the time, for things like weather or GPX recording apps. But it's also important to remember that the vast majority (easily 90%) of devices out there are running EoL'd Android versions, nevermind Android 12 and 13.
  - charcircuit 4y ago
    >you can still set permissions to use e.g. GPS all the time It requires you to manually go into the settings to grant this permission. And as I mentioned it has a persistent notification. This is a part of Android 11. >But it's also important to remember that the vast majority (easily 90%) of devices out there are running EoL'd Android versions This is unfortunate. If want to have a secure device it's important to be using one which is still supported and is getting security updates. Else if a vulnerability exists an attacker can install spyware by using the vulnerability despite Android's security model.
senthil_rajasek 4y ago
I found this article very shallow. It covers only spyware that are installed when a device is physically compromised. I was hoping it would cover spy/malware that install remotely through many more infection vectors like clicking text messages. I guess NSO/Pegasus malware has this capability. I barely use any apps and would gladly settle for a flip phone... I value privacy more than the ability to order food through my phone.
- TheRealDunkirk 4y ago
  > I value privacy more than the ability to order food through my phone. I know you didn't mean it like this, but I find it funny that it reads like we've abandoned the idea of calling a restaurant and just talking to a person to order takeaway.
  - walterbell 4y ago
    > talking to a person to order takeaway Also supports small business by saving them double-digit app fees!
    - Jeremy1026 4y ago
      Not necessarily. The delivery apps set up proxy numbers to pass calls through, taking a lead fee. So you can't just search "sub shop near me" and call, as it might not be their actual phone number. Your best bet if you want to save the local place fees from the apps is walk in the first time, then call the number off the paper menu from then on.
      - xeromal 4y ago
        If they have a website, that's usually a good number too
      - walterbell 4y ago
        PiTM (Parasite in The Middle)
    - 4y ago
sizzle 4y ago
Some of these employee/child “monitoring” apps rival Remote Access Trojans (RATs) that used to wreak havoc in the early days of Windows, before Windows Defender and detailed permissions level access prompts were brought to the attention of the user (Windows UAC (User Account Control prompts). I feel like mobile operating systems have been stuck in the early Windows “undetectable RAT era” for far too long, only recently getting basic UI prompts for oversight/control of OS-level permissions settings per app. I believe it was Apple that forced this privacy angle on the smartphone space and Android was forced to comply, since Android and Google’s business model is to track, profile and harvest user generated data for targeted advertising. AdTech is too profitable and has pervase incentives to keep spying on users. With all that said, I really respect the approach the EU takes to safeguard privacy and enforce compliance from big corps.
lisasays 4y ago
So what do people recommend for malware detection (at whatever degree of efficacy) on Androids these days? Yes I know what search engines are, but I'd appreciate curated / personal recommendations, please.
- kramerger 4y ago
  Nothing. Anyone recommending antivirus apps for your android is clueless and/or after your money.
  - lisasays 4y ago
    Okay, I'm clueless. Can you condescend to explain why this is the case, and/or provide something informative to read about the subjective? BTW I really am clueless, because I've avoided owning any kind of smartphone until now.
    - chaxor 4y ago
      A non answer / misdirection here may be to not go for tacking on malware detection to an already malware prone / hostile operating system, and rather start in a better position by using something like grapheneos. Having more control over what happens on the system is important to get malware in the first place. I imagine even more secure OSes will be coming out soon based on Rust, etc but the last time I checked GrapheneOS was a decent choice.
      - lisasays 4y ago
        I am now educated. Thank you.
- sizzle 4y ago
  Don’t place your trust in companies that have business models built on the mass collection of user data for selling targeted advertising.
mcsniff 4y ago
Ctrl-F "Graphene". Nobody has mentioned GrapheneOS. GrapheneOS and a Pixel phone are about as private and secure as you can get whilst maintaining good usability of a smartphone in 2023. Highly recommended, no affiliation.
- okamiueru 4y ago
  How does it compare to CalyxOS?
- hackernewds 4y ago
  Why Pixel phone, given it's Google
sasas 4y ago
TLDR; purchase an device that pairs with your phone, follow a hunch that it's doing a lot more then what it advertises it does. A week ago I purchased a bluetooth device that takes some measurements. You require an Android or iOS application. The first thing the iOS app did was request permission for your location. Immediate fired up MITMproxy [1] running in transparent `--mode wireguard` and installed it's certificate in the iOS trust store. It was sending a whole bunch of data to China and HK. Since I don't have a jailbroken iPhone, it's off to Android. For BLE scanning, Android does require permissions for location, but this application is using a Chinese branded tracking SDK and sending encrypted blobs (within already encrypted TLS). So it's time to start reversing and instrumenting the runtime. Well - not so easy, they used a commercial packer that encrypts their compiled bytecode and decrypts and I think executes it within C++ library that might be an actual interpreter. I managed to pull the Dalvik bytecode out of memory using Frida[2] after the packer had decrypted the base application and converted it to java bytecode with dex2jar[3] then into decompiled java with jadx [4]. Since the developer relied on the packer to hide/obfuscate their software, it's quite easy to follow the deobsfucated code. The libraries that do the location tracking on the otherhand are obfuscated so now I'm at the stage of identifying where to hook before the encrypted blobs are sent to servers in China. Here it would be nice to have a call flow graph generated based on the static decompiled java code - can anyone recommend anything? I've sunk about 8 hours into this so far. The message here is that to understand what some applications on your phone does you need to really invest time and effort. The developers increase the cost to the consumer to know what their application is doing by obfuscation, encryption and packing. It's asymmetric. Also note: the play store and apple store state the app does not send data, which is demonstrably false. I can also see that the tracking SDK has what looks like functionality to dynamically invoke code - which would break the terms and conditions of the app stores. At some point I will reimplement it's primary BLE functionality and release it as opensource to the public and perhaps write a blog post. [1] https://mitmproxy.org/posts/wireguard-mode/ https://mitmproxy.org/posts/wireguard-mode/ [2] https://frida.re/docs/android/ https://frida.re/docs/android/ [3] https://github.com/pxb1988/dex2jar https://github.com/pxb1988/dex2jar [4] https://github.com/skylot/jadx https://github.com/skylot/jadx
- gabanutrition 4y ago
  This topic is intriguing. Could you please provide more information about the device and application? I'd appreciate the opportunity to examine them more thoroughly.
eth0up 4y ago
A recent, peculiar experience: After replacing a damaged Moto with a (presumably) identical one, several months later, before leaving for work, I invoke my trusty old VPN for its maiden journey on my new device. But it won't connect. Because 'Why?', I'm not certain, but the permission dialogue for initial use wasn't appearing, while the VPN was requesting that I grant it permission... but I couldn't manually do so, because... I then examine my network settings, and a queer surprise rears its absence -- The VPN setting/option is simply missing. Not there. AWOL. I tuck in to hasty research (what's watching?) and find that I'm not alone. But I've insufficient time to troubleshoot. I go to work. After work I resume, though find that the VPN now works and the options under network settings now includes 'VPN'. Automagically fixed. Although I had rebooted the device several times that morning, it had not rebooted since - I know this do to examining Running Services, some of which I manually stop after every reboot, and were still inactive. I connect to ADB and peruse the logs. Not knowing exactly where to look, I find nothing relevant. I
diego_sandoval 4y ago
I would actually like to install a tracking/remote-control app on my own phone in case it gets stolen, but can't seem to find any app that satisfies my requirements. I need it to be open source, not require Google Play Services and not connect to a hardcoded service, but allow me to phone home to an IP address/URL that I specify myself. Basically, an SSH server configured with reverse tunneling, that instead of just giving me a shell, gives me a control panel to configure high-level features of Android.
- ashwagary 4y ago
  With a rooted Android phone you can run an SSH server using tools available on F-Droid (like SimpleSSHD).
clocot 4y ago
[dead]

184 points by sizzle 4y ago

[dead]

Maybe I missed it, but I didn't see a link to the actual paper, I think this is it from the conference site: https://petsymposium.org/popets/2023/popets-2023-0013.php https://petsymposium.org/popets/2023/popets-2023-0013.php

sizzle 4y ago
Thanks for linking to the paper

victor106 4y ago

The title needs to be updated to say “Android”

sizzle 4y ago
There are surreptitious ways to achieving covert monitoring on iOS. To say this applies to Android only is simply untrue. You can do things via MDM on iOS for example and install spyware “monitoring” apps/set OS level permissions that are invisible to non tech saavy users. Also if you have access to the device and the iCloud password/device pin (e.g. abusive partner scenario, etc.) then non tech saavy people don’t stand a chance against being secretly monitored.
- CharlesW 4y ago
  > To say this applies to Android only is simply untrue. To be fair, this particular issue — the creative abuse of Android APIs by "stalkerware" apps — applies to Android only. Also, MDMs on iPhones can't do the kinds of covert monitoring that this paper discusses. They can't access texts, emails, photos or other personal messages or data within apps on a device.
  - paulmd 4y ago
    well, thanks to the EU, it's going to apply to Apple real soon too. This is one of the things app store review and fully enforcable permissioning prevents (prevented). https://9to5mac.com/2022/12/13/apple-alternative-app-stores-iphone/ https://9to5mac.com/2022/12/13/apple-alternative-app-stores-... So much for the "app store is like 1984" marketing spin that Epic put out lol. Now you have the freedom to have spyware installed on your phone... which is what I and many others have been saying all along. Not just abusive spouses but Facebook and others will be all over this. https://www.youtube.com/watch?v=euiSHuaw6Q4 https://www.youtube.com/watch?v=euiSHuaw6Q4 As I said previously... Facebook and others already have this sort of spyware ready to go, because they were already using their developer credentials to get users to sideload it for data mining. Now it won't be optional/"we'll give you a gift card", it'll just be mandatory if you want to use Facebook on a ios device. Sorry this device is not supported via web, please install the native app. https://arstechnica.com/gadgets/2019/01/facebook-and-google-offered-gift-cards-for-root-level-access-to-ios-users-data/ https://arstechnica.com/gadgets/2019/01/facebook-and-google-...
  - sizzle 4y ago
    honestly all they need to monitor people is built into Apple products out of the box. Sync a dummy iCloud enabled AppleID, and clear all the prompts and emails that the device was added to the account. You now have access to everything via iCloud and FindMy app for location tracking. You can even sign into another device and have real-time iMessage and other private data without installing any spyware apps. I will admit this is outside the scope of the paper, but arguably harder to mitigate if you are not ever checking your iCloud settings.
- baxtr 4y ago
  I don’t think it’s black and white. But the two systems are pretty much on opposite end of the spectrum.
- cyberbanjo 4y ago
  TFA: We focus on Android-based spyware because most of the mobile spyware market appears to be focused there. Since curated app stores like Google Play do not permit the sale of such apps, in practice they must be side-loaded off-store, a process that Apple does not support. As a result, consumer mobile spyware only operates on “rooted” iPhones. Rooting an iPhone can be a technically involved operation (one popular guide to jailbreaking the iPhone involves 41 distinct steps [17]) and one that can take significant time to complete — both requirements at odds with the broad, non-technical customer base such apps are marketed to. We also focus on leading spyware apps as they are the apps that more people are exposed to and they are more likely to be innovative (new features could potentially bring them more customers).
  - scarface74 4y ago
    And you think the Google Play Store (or the App Store) for that matter could even know what apps are doing? With iOS, the protection comes from its tighter permissions model and sandboxing
    - kramerger 4y ago
      Are those two really significantly different in sandboxing and permission model? Should also point out that neither app store is perfect and both have let malicious app slip through. Thanks to the Epic lawsuit we also know that they have tried to hide major incidents ( as in 500M installs of potential malware) from consumers.
      - scarface74 4y ago
        Yes, there is no API on iOS that allows most of the things listed in the article that apps can use even it tried to use non documented APIs. > After installation, they covertly record the victim’s device activities — including any text messages, emails, photos, or voice calls — and allow abusers to remotely review this information through a web portal And the “malware” that was installed was because people were using hacked XCode versions that didn’t come from Apple and they still didn’t escape the sandbox.
- scarface74 4y ago
  Even with someone’s iCloud password and physical access to your phone, a normal app can’t access your phone logs, your camera while running in the background, record your screen etc, even with an MDM.
- bartvk 4y ago
  > You can do things via MDM on iOS for example and install spyware “monitoring” apps Can you name one?
  - sizzle 4y ago
    I mentioned a different scenario involving iCloud, please see my comment above.
- randomwebuser 4y ago
  Thank you for saying this. I agree with OP concerning the article. I work in finance and if people knew just how clueless even we are when it comes to devices being compromised they would never use an app or website for banking again. Even if we can tell it wasn’t the account holder it’s extremely hard to do much more than that. No one knows what to tell the poor person either. I take a hit and get in trouble for my hour call giving instructions but rather that than see someone suffer. Also bad for people with stalkers/abusive partners. I don’t know why everyone says it’s so hard to compromise a device/number (either platform) when it’s not. Or maybe I’m just in a position where I see it more often and overall it is hard? My day job minimum of 2 a day, confirmed not counting otherwise. Volunteer work, its not as frequent but also don’t deal with same volume of people. It is creepier though and no one knows what to do. One case working w a big agency as it involves a high dollar amount and is ongoing and THEY can’t seem to give advice that works either. Person at this point went to a flip phone. Reset the phone? Didn’t work. Abandon all accounts, reset phone, cool. Didn’t work. K now all of the above and dump the number, and/or replace entire phone, latter usually works but not always. Sorry this is long here is my point in commenting. I wish someone with knowledge would take the time to do a solid write up for people with zero tech knowledge not just how to protect themselves but how to determine if/how they are compromised, log proof if possible (court etc) get rid of it and move forward safely, or as safe as possible for both android and IOS, a comprehensive write up. They would be a super hero. Literally help countless. It would help people like the 83 y/o grandma who got cleaned out THREE TIMES and cried to me begging for help on how to stop it, the women whose abusive exes show up at shelters because they have accessed sms or location despite the women using precautions given to them as the precautions are not up to date with what’s possible. Forgive me, it gets to me some of the most vulnerable people are dealing with this at an alarming rate and the people they are told to get help from genuinely don’t know what to do, while I know some it’s not enough to truly be of help say if someone has a well versed ex determined to hunt them down. These people could care less about the Gov knowing all, they just want to be safe.
photochemsyn 4y ago
This quote in the article seems overly optimistic: > "While Google does not permit the sale of such apps on its Google Play app store, Android phones commonly allow such invasive apps to be downloaded separately via the Web. The iPhone, in comparison, does not allow such “side loading” and thus consumer spyware apps on this platform tend to be far more limited and less invasive in capabilities." Recommended: https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/ https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents... > "After confirming forensic traces of Pegasus on Nour’s iPhone, we identified the presence of additional spyware, which we attribute with high confidence to Cytrox. We further conclude with high confidence that it is unrelated to Pegasus spyware."
- CharlesW 4y ago
  Once an iPhone is jailbroken, yes — anything goes. The paper describes an Android attack that just requires an app install that "[does] not require specialized technical know-how to deploy or operate".
  - paulmd 4y ago
    or more generally when you're going up against nation-state level actors, such as in your link. In that case yeah all bets are off, NSA and Mossad (and places commercializing technology developed for them) are gonna get in your phone if they want to. But this is still qualitatively different from android where the threat model is "connect USB cable and run ADB command", if even that much.
    - hot_gril 4y ago
      At the end of the day, tech-illiterate people are gonna get spyware onto their Android phones much more easily. If a website tells them to download some app directly and ignore any warnings about it being untrusted, they'll do it.

mikece 4y ago

"When your phone is spying on you"??? The title makes it sound like this isn't a 24x7x365 concern when it very much is!

zw123456 4y ago

Something happened to me the other day, I started drafting a text using the regular text messaging app on my android phone, I was sending it to a friend, but I got distracted by a call and never sent the text. Later I went to finish it and send it but he had gone in and put some smart-alec comment in the text of the message I was drafting. I was shocked. He refuses to tell me how he did it. I went through all the settings, scans permissions and so on. He says he can't do it now but still refuses to tell me how he did it. Scary. I wish I could find out what it was he did. Any HN'ers have any ideas?

jtbayly 4y ago
Were the two of you ever in physical proximity?
- zw123456 4y ago
  Yeah, I replied in the thread earlier, I suspect he saw me put my pin in. But at the time it happened he was on the other side of town.
  - sizzle 4y ago
    Change your pin and see if he added his fingerprint or Face ID to unlock then dump them for being a privacy invading friend
robin_reala 4y ago
Hate to say it, but he doesn’t sound like much of a friend if he’s owned your phone and refuses to elaborate on how.
- BiteCode_dev 4y ago
  Sounds like a good joke to be of either side on to me. No harm done.
  - jabroni_salad 4y ago

charcircuit 4y ago

>They collect a range of sensitive information such as location, texts and calls, as well as audio and video. This sentence ruins the credibility of the article because Android doesn't let you do this. The camera, microphone, can only be used when an app is in the foreground. For location data being tracked in the background it will have a persistent notification telling the user that an app has your location. For an app to read your call log or SMSs it has to be set as the phone's default phone or SMS app. This combined with androids reminders to review the permissions for apps that have dangerous permissions and Play Protect which can detect and remove spyware this article is giving Android much less credit than it deserves.

b112 4y ago
Doesn't overlay do the same?
- charcircuit 4y ago
  Do you mean having a persistent notification? Yes, it does.
uoaei 4y ago
> The camera, microphone, can only be used when an app is in the foreground. This is not true. This may be partially true on the latest Android, but you can still set permissions to use e.g. GPS all the time, for things like weather or GPX recording apps. But it's also important to remember that the vast majority (easily 90%) of devices out there are running EoL'd Android versions, nevermind Android 12 and 13.
- charcircuit 4y ago
  >you can still set permissions to use e.g. GPS all the time It requires you to manually go into the settings to grant this permission. And as I mentioned it has a persistent notification. This is a part of Android 11. >But it's also important to remember that the vast majority (easily 90%) of devices out there are running EoL'd Android versions This is unfortunate. If want to have a secure device it's important to be using one which is still supported and is getting security updates. Else if a vulnerability exists an attacker can install spyware by using the vulnerability despite Android's security model.

senthil_rajasek 4y ago

I found this article very shallow. It covers only spyware that are installed when a device is physically compromised. I was hoping it would cover spy/malware that install remotely through many more infection vectors like clicking text messages. I guess NSO/Pegasus malware has this capability. I barely use any apps and would gladly settle for a flip phone... I value privacy more than the ability to order food through my phone.

TheRealDunkirk 4y ago
> I value privacy more than the ability to order food through my phone. I know you didn't mean it like this, but I find it funny that it reads like we've abandoned the idea of calling a restaurant and just talking to a person to order takeaway.
- walterbell 4y ago
  > talking to a person to order takeaway Also supports small business by saving them double-digit app fees!
  - Jeremy1026 4y ago
    Not necessarily. The delivery apps set up proxy numbers to pass calls through, taking a lead fee. So you can't just search "sub shop near me" and call, as it might not be their actual phone number. Your best bet if you want to save the local place fees from the apps is walk in the first time, then call the number off the paper menu from then on.
    - xeromal 4y ago
      If they have a website, that's usually a good number too
    - walterbell 4y ago
      PiTM (Parasite in The Middle)
  - 4y ago

sizzle 4y ago

Some of these employee/child “monitoring” apps rival Remote Access Trojans (RATs) that used to wreak havoc in the early days of Windows, before Windows Defender and detailed permissions level access prompts were brought to the attention of the user (Windows UAC (User Account Control prompts). I feel like mobile operating systems have been stuck in the early Windows “undetectable RAT era” for far too long, only recently getting basic UI prompts for oversight/control of OS-level permissions settings per app. I believe it was Apple that forced this privacy angle on the smartphone space and Android was forced to comply, since Android and Google’s business model is to track, profile and harvest user generated data for targeted advertising. AdTech is too profitable and has pervase incentives to keep spying on users. With all that said, I really respect the approach the EU takes to safeguard privacy and enforce compliance from big corps.

lisasays 4y ago

So what do people recommend for malware detection (at whatever degree of efficacy) on Androids these days? Yes I know what search engines are, but I'd appreciate curated / personal recommendations, please.

kramerger 4y ago
Nothing. Anyone recommending antivirus apps for your android is clueless and/or after your money.
- lisasays 4y ago
  Okay, I'm clueless. Can you condescend to explain why this is the case, and/or provide something informative to read about the subjective? BTW I really am clueless, because I've avoided owning any kind of smartphone until now.
  - chaxor 4y ago
    A non answer / misdirection here may be to not go for tacking on malware detection to an already malware prone / hostile operating system, and rather start in a better position by using something like grapheneos. Having more control over what happens on the system is important to get malware in the first place. I imagine even more secure OSes will be coming out soon based on Rust, etc but the last time I checked GrapheneOS was a decent choice.
    - lisasays 4y ago
      I am now educated. Thank you.
sizzle 4y ago
Don’t place your trust in companies that have business models built on the mass collection of user data for selling targeted advertising.

mcsniff 4y ago

Ctrl-F "Graphene". Nobody has mentioned GrapheneOS. GrapheneOS and a Pixel phone are about as private and secure as you can get whilst maintaining good usability of a smartphone in 2023. Highly recommended, no affiliation.

okamiueru 4y ago
How does it compare to CalyxOS?
hackernewds 4y ago
Why Pixel phone, given it's Google

sasas 4y ago

TLDR; purchase an device that pairs with your phone, follow a hunch that it's doing a lot more then what it advertises it does. A week ago I purchased a bluetooth device that takes some measurements. You require an Android or iOS application. The first thing the iOS app did was request permission for your location. Immediate fired up MITMproxy [1] running in transparent `--mode wireguard` and installed it's certificate in the iOS trust store. It was sending a whole bunch of data to China and HK. Since I don't have a jailbroken iPhone, it's off to Android. For BLE scanning, Android does require permissions for location, but this application is using a Chinese branded tracking SDK and sending encrypted blobs (within already encrypted TLS). So it's time to start reversing and instrumenting the runtime. Well - not so easy, they used a commercial packer that encrypts their compiled bytecode and decrypts and I think executes it within C++ library that might be an actual interpreter. I managed to pull the Dalvik bytecode out of memory using Frida[2] after the packer had decrypted the base application and converted it to java bytecode with dex2jar[3] then into decompiled java with jadx [4]. Since the developer relied on the packer to hide/obfuscate their software, it's quite easy to follow the deobsfucated code. The libraries that do the location tracking on the otherhand are obfuscated so now I'm at the stage of identifying where to hook before the encrypted blobs are sent to servers in China. Here it would be nice to have a call flow graph generated based on the static decompiled java code - can anyone recommend anything? I've sunk about 8 hours into this so far. The message here is that to understand what some applications on your phone does you need to really invest time and effort. The developers increase the cost to the consumer to know what their application is doing by obfuscation, encryption and packing. It's asymmetric. Also note: the play store and apple store state the app does not send data, which is demonstrably false. I can also see that the tracking SDK has what looks like functionality to dynamically invoke code - which would break the terms and conditions of the app stores. At some point I will reimplement it's primary BLE functionality and release it as opensource to the public and perhaps write a blog post. [1] https://mitmproxy.org/posts/wireguard-mode/ https://mitmproxy.org/posts/wireguard-mode/ [2] https://frida.re/docs/android/ https://frida.re/docs/android/ [3] https://github.com/pxb1988/dex2jar https://github.com/pxb1988/dex2jar [4] https://github.com/skylot/jadx https://github.com/skylot/jadx

gabanutrition 4y ago
This topic is intriguing. Could you please provide more information about the device and application? I'd appreciate the opportunity to examine them more thoroughly.

eth0up 4y ago

A recent, peculiar experience: After replacing a damaged Moto with a (presumably) identical one, several months later, before leaving for work, I invoke my trusty old VPN for its maiden journey on my new device. But it won't connect. Because 'Why?', I'm not certain, but the permission dialogue for initial use wasn't appearing, while the VPN was requesting that I grant it permission... but I couldn't manually do so, because... I then examine my network settings, and a queer surprise rears its absence -- The VPN setting/option is simply missing. Not there. AWOL. I tuck in to hasty research (what's watching?) and find that I'm not alone. But I've insufficient time to troubleshoot. I go to work. After work I resume, though find that the VPN now works and the options under network settings now includes 'VPN'. Automagically fixed. Although I had rebooted the device several times that morning, it had not rebooted since - I know this do to examining Running Services, some of which I manually stop after every reboot, and were still inactive. I connect to ADB and peruse the logs. Not knowing exactly where to look, I find nothing relevant. I

diego_sandoval 4y ago

I would actually like to install a tracking/remote-control app on my own phone in case it gets stolen, but can't seem to find any app that satisfies my requirements. I need it to be open source, not require Google Play Services and not connect to a hardcoded service, but allow me to phone home to an IP address/URL that I specify myself. Basically, an SSH server configured with reverse tunneling, that instead of just giving me a shell, gives me a control panel to configure high-level features of Android.

ashwagary 4y ago
With a rooted Android phone you can run an SSH server using tools available on F-Droid (like SimpleSSHD).

clocot 4y ago

[dead]