System Information Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, and architecture.
On Android, much of this information is programmatically accessible to applications through the android.os.Build class.[1]
On iOS, techniques exist for applications to programmatically access this information.[2]
Procedure Examples
| Name | Description |
|---|---|
| Android/Chuli.A |
Android/Chuli.A gathered system information including phone number, OS version, phone model, and SDK version.[6] |
| ANDROIDOS_ANSERVER.A |
ANDROIDOS_ANSERVER.A gathers the device OS version, device build version, manufacturer, and model.[8] |
| Anubis | |
| Cerberus |
Cerberus can collect device information, such as the default SMS app and device locale.[22][23] |
| Corona Updates |
Corona Updates can collect various pieces of device information, including OS version, phone model, and manufacturer.[18] |
| Dvmap |
Dvmap checks the Android version to determine which system library to patch.[15] |
| EventBot |
EventBot can collect system information such as OS version, device vendor, and the type of screen lock that is active on the device.[21] |
| GolfSpy |
GolfSpy can obtain the device’s battery level, network operator, connection information, sensor information, and information about the device’s storage and memory.[16] |
| Gustuff |
Gustuff gathers information about the device, including the default SMS application, if SafetyNet is enabled, the battery level, the operating system version, and if the malware has elevated permissions.[11] |
| INSOMNIA |
INSOMNIA can collect the device’s name, serial number, iOS version, total disk space, and free disk space.[20] |
| KeyRaider |
Most KeyRaider samples search to find the Apple account's username, password and device's GUID in data being transferred.[5] |
| Monokle |
Monokle queries the device for metadata such as make, model, and power levels.[12] |
| Pallas |
Pallas queries the device for metadata, such as device ID, OS version, and the number of cameras.[9] |
| Pegasus for iOS |
Pegasus for iOS monitors the victim for status and disables other access to the phone by other jailbreaking software.[7] |
| RedDrop |
RedDrop exfiltrates details of the victim device operating system and manufacturer.[3] |
| Riltok |
Riltok can query various details about the device, including phone number, country, mobile operator, model, root availability, and operating system version.[10] |
| Rotexy |
Rotexy collects information about the compromised device, including phone number, network operator, OS version, device model, and the device registration country.[13] |
| RuMMS |
RuMMS gathers device model and operating system version information and transmits it to a command and control server.[4] |
| TrickMo |
TrickMo can collect device information such as network operator, model, brand, and OS version.[19] |
| ViceLeaker |
ViceLeaker collects device information, including the device model and OS version.[14] |
Mitigations
| Mitigation | Description |
|---|---|
| Application Vetting |
App vetting procedures can search for apps that use the android.os.Build class, but these procedures could potentially be evaded and are likely not practical in this case, as many apps are likely to use this functionality as part of their legitimate behavior. |
References
- Android. (n.d.). Build. Retrieved December 21, 2016.
- Stack Overflow. (n.d.). How can we programmatically detect which iOS version is device running on?. Retrieved December 21, 2016.
- Nell Campbell. (2018, February 27). RedDrop: the blackmailing mobile malware family lurking in app stores. Retrieved September 18, 2018.
- Wu Zhou, Deyu Hu, Jimmy Su, Yong Kang. (2016, April 26). RUMMS: THE LATEST FAMILY OF ANDROID MALWARE ATTACKING USERS IN RUSSIA VIA SMS PHISHING. Retrieved February 6, 2017.
- Claud Xiao. (2015, August 30). KeyRaider: iOS Malware Steals Over 225,000 Apple Accounts to Create Free App Utopia. Retrieved December 12, 2016.
- Costin Raiu, Denis Maslennikov, Kurt Baumgartner. (2013, March 26). Android Trojan Found in Targeted Attack. Retrieved December 23, 2016.
- Lookout. (2016). Technical Analysis of Pegasus Spyware. Retrieved December 12, 2016.
- Karl Dominguez. (2011, September 27). ANDROIDOS_ANSERVER.A. Retrieved November 30, 2018.
- Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.
- Tatyana Shishkova. (2019, June 25). Riltok mobile Trojan: A banker with global reach. Retrieved August 7, 2019.
- Vitor Ventura. (2019, April 9). Gustuff banking botnet targets Australia . Retrieved September 3, 2019.
- Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.
- T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.
- GReAT. (2019, June 26). ViceLeaker Operation: mobile espionage targeting Middle East. Retrieved November 21, 2019.
- R. Unuchek. (2017, June 8). Dvmap: the first Android malware with code injection. Retrieved December 10, 2019.
- E. Xu, G. Guo. (2019, June 28). Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.
- M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved April 8, 2020.
- T. Bao, J. Lu. (2020, April 14). Coronavirus Update App Leads to Project Spy Android and iOS Spyware. Retrieved April 24, 2020.
- P. Asinovsky. (2020, March 24). TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany. Retrieved April 24, 2020.
- I. Beer. (2019, August 29). Implant Teardown. Retrieved June 2, 2020.
- D. Frank, L. Rochberger, Y. Rimmer, A. Dahan. (2020, April 30). EventBot: A New Mobile Banking Trojan is Born. Retrieved June 26, 2020.
- Threat Fabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved June 26, 2020.
- A. Hazum, B. Melnykov, C. Efrati, D. Golubenko, I. Wernik, L. Kuperman, O. Mana. (2020, April 29). First seen in the wild – Malware uses Corporate MDM as attack vector. Retrieved June 26, 2020.