Mobile
News
8/3/2011
10:51 PM
50%
50%

Threat Level Downgrade: Call-Recording Android Trojan

After close inspection of the so-called Trojan, Symantec security researchers find it's not all it was cracked up to be.

Call-Recording Android Trojan
(click image for larger view)
Call-Recording Android Trojan
Earlier this week, Total Defense security researcher Dinesh Vinkatesan broke news of a pernicious-sounding security threat for Android devices. According to Vinkatesan's post on the CA Security Advisor Research Blog, this threat is a Trojan horse malware application capable of recording a user's phone calls and uploading them to a remote server.

It sounds pretty bad. And it would be, if it were true. But according to new information released today by Symantec security analyst Irfan Asrar on the Symantec Security Response Blog, the threat known as Android.Nickispy doesn't look so menacing after all.

In the Monday blog post that launched this story, Dinesh Vinkatesan was less than revealing about the source of the app, saying only, "today we have received an Android package to our collection and observed that this piece of malware walks an additional mile by having a neat configuration and has a capability to record the telephonic conversation the infected victim makes." With that kind of description, it's no wonder security-conscious tech audiences took a keen interest in this package.

According to Symantec's Irfan Asrar, however, the app is widely available on multiple sites in China, with no effort made to conceal its function. "The author had clearly stated the purpose, so anyone installing this app could not be mistaken in its intentions," said Asrar. "Now that's not to say someone couldn't install it on another person's phone. Still, on completion of installation the app actually shows up with an icon marked Speech Recorder, clearly visible to the user." So if you were worried that such an app might surreptitiously appear on your device, breathe easy.

More surprisingly, Asrar said Symantec has found no evidence of the app's ability to upload calls to a remote server. "It can record calls; however, physical access to the device is required in order to retrieve them," said Asrar. The worst this app can do is upload GPS, SMS, and call logs.

While the case of the call-recording "Trojan" appears pretty open-and-shut, it does--as my colleague Laurianne McLaughlin pointed out, highlight a pervasive problem of trust with mobile security. While it's unfathomably unlikely that anyone would ever inadvertently install this app on their own device, it's conceivable that someone else could install something like it without their knowledge, burying the icon in a cluttered applications list. In such a circumstance, an app like this could go unnoticed for days, possibly weeks, betraying the phone's owner at every turn.

The silver lining to this story--if we can call it that--is that the app doesn't even work as advertised. The Symantec team was able to track down the author of Android.Nickispy through questions posted to an Android developer forum. "By doing an online search on the crash details accompanied in the error logs, we found a posted crash dump of the exact same issue," said Asrar, "where a developer was asking for urgent help with the code he or she was working on. A closer look at details of the posted crash dump showed that it had the same package name used in the threat." Despite the year that has passed since the app's author posted that query to the dev forum, Asrar said, "it's still crashing most of the time on a real phone."

InformationWeek Analytics is conducting a survey on mobile device management and security. Respond to the survey and be eligible to win an iPod Touch. Take the survey now. Survey ends Aug. 5.

Comment  | 
Print  | 
More Insights
InformationWeek Elite 100
InformationWeek Elite 100
Our data shows these innovators using digital technology in two key areas: providing better products and cutting costs. Almost half of them expect to introduce a new IT-led product this year, and 46% are using technology to make business processes more efficient.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest, Dec. 9, 2014
Apps will make or break the tablet as a work device, but don't shortchange critical factors related to hardware, security, peripherals, and integration.
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
Join us for a roundup of the top stories on InformationWeek.com for the week of December 14, 2014. Be here for the show and for the incredible Friday Afternoon Conversation that runs beside the program.
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.