AOH :: ISNQ5425.HTM

BLACK HAT - Analyst: Money will fuel mobile spying programs




BLACK HAT - Analyst: Money will fuel mobile spying programs
BLACK HAT - Analyst: Money will fuel mobile spying programs



http://www.pcworld.idg.com.au/index.php/id;1126249158 

By Jeremy Kirk 
IDG News Service
31/03/2008 

Spying programs for mobile phones are likely to grow in sophistication 
and stealth as the business around selling the tools grows, according to 
a mobile analyst at the Black Hat conference on Friday.

Many of the spy programs on the market are powerful, but aren't very 
sophisticated code, said Jarno Niemela, a senior antivirus researchers 
for Finnish security vendor F-Secure, which makes security products for 
PCs and mobile phones.

But there is increasing evidence that money from selling the tools will 
create a stronger incentive for more accomplished programmers to get 
into the game, which could make the programs harder to detect, Niemela 
said.

Niemela said his prediction follows what has happened with the malware 
writers in the PC market. Many hackers are now in the business of 
selling easy-to-use tools to less technical hackers rather than hacking 
into PCs themselves.

One of the latest tools on the market is Mobile SpySuite, which Niemela 
believes is the first spy tool generator for mobiles. It sells for 
US$12,500 and would let a hacker custom-build a spy tool aimed at 
several models of Nokia phones, Niemela said.

The number of mobile spyware programs pales in comparison to the number 
of such programs available for PCs. However, mobile spying programs are 
harder to track, since security companies such as F-Secure don't see as 
many samples circulating on the Internet as they do of malicious 
software for PCs.

Anecdotal evidence has emerged that enterprises may be increasingly 
encountering mobile spyware on their fleets of phones. The clues have 
come from companies that are relatively cagey when talking about what 
they have seen.

"There have been certain cases of corporate customers asking very 
detailed questions about spy tools and not mentioning why they need the 
information," Niemela said.

Some of the more well-known spy programs are Neo-cal land FlexiSpy. 
Neo-call is capable of secretely forwarding SMS (Short Message Service) 
text messages to another phone, transmitting a list of phone numbers 
called, and logging keystrokes. FlexiSpy has a neat, Web-based interface 
that shows details of call times, numbers and SMSes, and it can even use 
a phone's GPS (Global Positioning System) receiver to pinpoint the 
victim's location.

Hackers usually need to have access to the phone itself to install the 
software. And OS manufacturers such as Symbian have enabled security 
features such as application signing, which is intended to prevent rogue 
programs from being installed on a phone.

Most rogue spying programs leave traces on the phone, and analysis tools 
can be used to check a phone's processes and file system to see if 
something is there that shouldn't be, Niemela said.

But there are ways that less technical users can get a hint they've been 
hacked. One simple clue is if a colleague of the victim knows something 
that they shouldn't, Niemela said.

Also, mobile spying programs have to transmit their data. If the spy 
program sends data over GPRS (General Packet Radio Service), the network 
operator will demand payment. "As long as it has to use a paid channel, 
it can not escape the operator's bill," Niemela said.

Another way is to replace the phone's SIM card with one that allows for 
real-time monitoring. SMSes can then be sent to the phone, which in many 
countries are free to receive. If the monitoring reveals outgoing data 
traffic after SMSes are received, the phone could be hacked. It's also 
possible to check if the GPRS connection icon lights up after a message 
is received, Niemela said.

Niemela offered some defenses against mobile spyware: Keep the OS up to 
date, as manufacturers are usually working to counter new devious 
software. The use of a mobile antivirus program is also prudent, he 
said. People should also use password protection to block access if 
someone gets a hold of the device.

Administrators can also regularly "flash" phones to wipe off malware, as 
well as ensuring that phones only install signed applications.

And when the phone is out of a person's hands, another option is to put 
the device in a tamper-proof container. But "for most people, this is 
way too James Bond," Niemela said.


___________________________________________________      
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn 

Site design & layout copyright © 1986-2014 CodeGods