How to turn any phone into a spy device with hardware hack

No peace for mobile environment that due its impressive increase is attracting cyber criminals and hackers like never before.

The researcher Atul Alex has presented at last edition of International Malware Conference (MalCon) how it is possible to attack every mobile devices with a special hardware designed using common electronic components.

Atul Alex presented a paper that covers “abusing voice dialing and combining Arduino / Microcontroller to steal private data on iphone, Android, Windows Phone and Blackberry using only the Audio jack.

Mobile devices are sophisticated devices that manage a huge quantity user’s information and their exploit could open the door to a mine of sensible data, due this reason the expert provides that in incoming months defense system will be reinforced and it will be more  difficult in the future software based attacks.

It must be considered that an efficient attack on large scale against mobile world have to be able to infect multi platform devices.

During its presentation Atul Alex explained how to transform any mobile device into a spy tool, avoiding the installation of any malicious software on it, abusing voice dialing feature which is enabled by default on all mobile platforms.

Modern devices are equipped with powerful software able to interpret user’s vocal commands, the hardware device proposed by Alex Atul is able to mimic them to give orders to the device. The functionality opens future scenarios in which hackers are able to control phone simply sending unauthorized text messages to steal sensible data.

Almost all events on the mobile are notified to the user with the help of corresponding tones/sounds, the researched has demonstrated that adding a microcontroller to the headset’s circuit is possible to:

• Initiate phone calls without user interaction.
• Note duration of phone calls.
• Detect incoming/outgoing calls,  sms & so on.

In the future versions the hardware could also integrate more complex functionalities such as recording of phone calls or remote activation of the device.

For sure similar devices will represent in the future a privileged option for cyber espionage operations and more in general for cyber operations. Many governments are working or financing projects for development of new cyber tools. Government agencies have massively invested in programs to “violate” citizen’s privacy in the name of national security, world is changed from 11/9 and the risk of a new dramatic cyber attack is high.

The Defense Advanced Research Projects Agency (DARPA) is one of the most advanced agency in this sense, it is responsible for the development of new technologies for use by the military and recently it has proposed a device called the Power Pwn designed by Pwnie Express company that apparently look like a surge protector, but it’s a powerful tool to infiltrate networks allowing remote access to every  machine.

How to defend our device from similar attacks? In the future every interface of mobile device have to be properly designed, every input must be validated by a specially designed circuitry.

Another factor to consider as critical is the qualification of hardware for devices similar to the one described in the research , different compromised components may invade the consumer market with disastrous consequences, it is necessary a great effort to avoid dangerous incidents.

Pierluigi Paganini