System Network Configuration Discovery
On Android, details of onboard network interfaces are accessible to apps through the java.net.NetworkInterface class.[1] The Android TelephonyManager class can be used to gather related information such as the IMSI, IMEI, and phone number.[2]
On iOS, gathering network configuration information is not possible without root access.
Procedure Examples
| Name | Description |
|---|---|
| ANDROIDOS_ANSERVER.A |
ANDROIDOS_ANSERVER.A gathers the device IMEI and IMSI.[12] |
| Bread |
Bread collects the device’s IMEI, carrier, mobile country code, and mobile network code.[20] |
| Corona Updates |
Corona Updates can collect device network configuration information, such as Wi-Fi SSID and IMSI.[18] |
| DualToy |
DualToy collects the connected iOS device’s information including IMEI, IMSI, ICCID, serial number and phone number.[11] |
| EventBot | |
| Exodus |
Exodus One queries the device for its IMEI code and the phone number in order to validate the target of a new infection.[14] |
| Gustuff |
Gustuff gathers the device IMEI to send to the command and control server.[15] |
| INSOMNIA |
INSOMNIA can collect the device’s phone number, ICCID, IMEI, and the currently active network interface (Wi-Fi or cellular).[21] |
| Monokle |
Monokle checks if the device is connected via Wi-Fi or mobile data.[16] |
| Pegasus for Android |
Pegasus for Android checks if the device is on Wi-Fi, a cellular network, and is roaming.[4] |
| Pegasus for iOS |
Pegasus for iOS monitors the connection state and tracks which types of networks the phone is connected to, potentially to determine the bandwidth and ability to send full data across the network.[10] |
| PJApps |
PJApps has the capability to collect and leak the victim's phone number, mobile device unique identifier (IMEI).[8] |
| RedDrop |
RedDrop collects and exfiltrates information including IMEI, IMSI, MNC, MCC, nearby Wi-Fi networks, and other device and SIM-related info.[7] |
| Riltok | |
| Rotexy |
Rotexy collects the device's IMEI and sends it to the command and control server.[17] |
| RuMMS |
RuMMS gathers the device phone number and IMEI and transmits them to a command and control server.[5] |
| SpyDealer |
SpyDealer harvests the device phone number, IMEI, and IMSI.[6] |
| Stealth Mango |
Stealth Mango collects and uploads information about changes in SIM card or phone numbers on the device.[9] |
| Tangelo | |
| TrickMo |
TrickMo can collect device network configuration information such as IMSI, IMEI, and Wi-Fi connection state.[19] |
Mitigations
| Mitigation | Description |
|---|---|
| Application Vetting |
Application vetting could be used to analyze applications to determine whether they access this information, including determining whether the application requests the Android ACCESS_NETWORK_STATE permission (required in order to access NetworkInterface information) or the READ_PHONE_STATE permission (required in order to access TelephonyManager information). |
| Use Recent OS Version |
Starting in Android 6.0, applications can no longer access MAC addresses of network interfaces.[3] |
References
- Android. (n.d.). NetworkInterface. Retrieved December 21, 2016.
- Android. (n.d.). TelephonyManager. Retrieved December 21, 2016.
- Android. (n.d.). Android 6.0 Changes. Retrieved December 21, 2016.
- Mike Murray. (2017, April 3). Pegasus for Android: the other side of the story emerges. Retrieved April 16, 2017.
- Wu Zhou, Deyu Hu, Jimmy Su, Yong Kang. (2016, April 26). RUMMS: THE LATEST FAMILY OF ANDROID MALWARE ATTACKING USERS IN RUSSIA VIA SMS PHISHING. Retrieved February 6, 2017.
- Wenjun Hu, Cong Zheng and Zhi Xu. (2017, July 6). SpyDealer: Android Trojan Spying on More Than 40 Apps. Retrieved September 18, 2018.
- Nell Campbell. (2018, February 27). RedDrop: the blackmailing mobile malware family lurking in app stores. Retrieved September 18, 2018.
- Lookout. (2016, May 25). 5 active mobile threats spoofing enterprise apps. Retrieved December 19, 2016.
- Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018.
- Lookout. (2016). Technical Analysis of Pegasus Spyware. Retrieved December 12, 2016.
- Claud Xiao. (2016, September 13). DualToy: New Windows Trojan Sideloads Risky Apps to Android and iOS Devices. Retrieved January 24, 2017.
- Karl Dominguez. (2011, September 27). ANDROIDOS_ANSERVER.A. Retrieved November 30, 2018.
- Tatyana Shishkova. (2019, June 25). Riltok mobile Trojan: A banker with global reach. Retrieved August 7, 2019.
- Security Without Borders. (2019, March 29). Exodus: New Android Spyware Made in Italy. Retrieved September 3, 2019.
- Vitor Ventura. (2019, April 9). Gustuff banking botnet targets Australia . Retrieved September 3, 2019.
- Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.
- T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.
- T. Bao, J. Lu. (2020, April 14). Coronavirus Update App Leads to Project Spy Android and iOS Spyware. Retrieved April 24, 2020.
- P. Asinovsky. (2020, March 24). TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany. Retrieved April 24, 2020.
- A. Guertin, V. Kotov, Android Security & Privacy Team. (2020, January 9). PHA Family Highlights: Bread (and Friends) . Retrieved April 27, 2020.
- I. Beer. (2019, August 29). Implant Teardown. Retrieved June 2, 2020.
- D. Frank, L. Rochberger, Y. Rimmer, A. Dahan. (2020, April 30). EventBot: A New Mobile Banking Trojan is Born. Retrieved June 26, 2020.