Threat Level Downgrade: Call-Recording Android Trojan - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Threat Level Downgrade: Call-Recording Android Trojan

After close inspection of the so-called Trojan, Symantec security researchers find it's not all it was cracked up to be.

Call-Recording Android Trojan
(click image for larger view)
Call-Recording Android Trojan
Earlier this week, Total Defense security researcher Dinesh Vinkatesan broke news of a pernicious-sounding security threat for Android devices. According to Vinkatesan's post on the CA Security Advisor Research Blog, this threat is a Trojan horse malware application capable of recording a user's phone calls and uploading them to a remote server.

It sounds pretty bad. And it would be, if it were true. But according to new information released today by Symantec security analyst Irfan Asrar on the Symantec Security Response Blog, the threat known as Android.Nickispy doesn't look so menacing after all.

In the Monday blog post that launched this story, Dinesh Vinkatesan was less than revealing about the source of the app, saying only, "today we have received an Android package to our collection and observed that this piece of malware walks an additional mile by having a neat configuration and has a capability to record the telephonic conversation the infected victim makes." With that kind of description, it's no wonder security-conscious tech audiences took a keen interest in this package.

According to Symantec's Irfan Asrar, however, the app is widely available on multiple sites in China, with no effort made to conceal its function. "The author had clearly stated the purpose, so anyone installing this app could not be mistaken in its intentions," said Asrar. "Now that's not to say someone couldn't install it on another person's phone. Still, on completion of installation the app actually shows up with an icon marked Speech Recorder, clearly visible to the user." So if you were worried that such an app might surreptitiously appear on your device, breathe easy.

More surprisingly, Asrar said Symantec has found no evidence of the app's ability to upload calls to a remote server. "It can record calls; however, physical access to the device is required in order to retrieve them," said Asrar. The worst this app can do is upload GPS, SMS, and call logs.

While the case of the call-recording "Trojan" appears pretty open-and-shut, it does--as my colleague Laurianne McLaughlin pointed out, highlight a pervasive problem of trust with mobile security. While it's unfathomably unlikely that anyone would ever inadvertently install this app on their own device, it's conceivable that someone else could install something like it without their knowledge, burying the icon in a cluttered applications list. In such a circumstance, an app like this could go unnoticed for days, possibly weeks, betraying the phone's owner at every turn.

The silver lining to this story--if we can call it that--is that the app doesn't even work as advertised. The Symantec team was able to track down the author of Android.Nickispy through questions posted to an Android developer forum. "By doing an online search on the crash details accompanied in the error logs, we found a posted crash dump of the exact same issue," said Asrar, "where a developer was asking for urgent help with the code he or she was working on. A closer look at details of the posted crash dump showed that it had the same package name used in the threat." Despite the year that has passed since the app's author posted that query to the dev forum, Asrar said, "it's still crashing most of the time on a real phone."

InformationWeek Analytics is conducting a survey on mobile device management and security. Respond to the survey and be eligible to win an iPod Touch. Take the survey now. Survey ends Aug. 5.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Data Science: How the Pandemic Has Affected 10 Popular Jobs
Cynthia Harvey, Freelance Journalist, InformationWeek,  9/9/2020
The Growing Security Priority for DevOps and Cloud Migration
Joao-Pierre S. Ruth, Senior Writer,  9/3/2020
Dark Side of AI: How to Make Artificial Intelligence Trustworthy
Guest Commentary, Guest Commentary,  9/15/2020
White Papers
Register for InformationWeek Newsletters
2020 State of DevOps Report
2020 State of DevOps Report
Download this report today to learn more about the key tools and technologies being utilized, and how organizations deal with the cultural and process changes that DevOps brings. The report also examines the barriers organizations face, as well as the rewards from DevOps including faster application delivery, higher quality products, and quicker recovery from errors in production.
Current Issue
IT Automation Transforms Network Management
In this special report we will examine the layers of automation and orchestration in IT operations, and how they can provide high availability and greater scale for modern applications and business demands.
Flash Poll