Enlarge (credit: Big Brother Utopia)
Researchers have discovered some of the most advanced and full-featured mobile surveillanceware ever seen. Dubbed Monokle and used in the wild since at least March 2016, the Android-based application was developed by a Russian defense contractor that was sanctioned in 2016 for helping that country’s Main Intelligence Directorate meddle in the 2016 US presidential election.
Monokle uses several novel tools, including the ability to modify the Android trusted-certificate store and a command-and-control network that can communicate over Internet TCP ports, email, text messages, or phone calls. The result: Monokle provides a host of surveillance capabilities that work even when an Internet connection is unavailable. According to a report published by Lookout, the mobile security provider that found Monokle is able to:
- Retrieve calendar information including name of event, when and where it is taking place, and description
- Perform man-in-the-middle attacks against HTTPS traffic and other types of TLS-protected communications
- Collect account information and retrieve messages for WhatsApp, Instagram, VK, Skype, imo
- Receive out-of-band messages via keywords (control phrases) delivered via SMS or from designated control phones
- Send text messages to an attacker-specified number
- Reset a user’s pincode
- Record environmental audio (and specify high, medium, or low quality)
- Make outgoing calls
- Record calls
- Interact with popular office applications to retrieve document text
- Take photos, videos, and screenshots
- Log passwords, including phone unlock PINs and key presses
- Retrieve cryptographic salts to aid in obtaining PINs and passwords stored on the device
- Accept commands from a set of specified phone numbers
- Retrieve contacts, emails, call histories, browsing histories, accounts and corresponding passwords
- Get device information including make, model, power levels, whether connections are over Wi-Fi or mobile data, and whether screen is on or off
- Execute arbitrary shell commands, as root, if root access is available
- Track device location
- Get nearby cell tower info
- List installed applications
- Get nearby Wi-Fi details
- Delete arbitrary files
- Download attacker-specified files
- Reboot a device
- Uninstall itself and remove all traces from an infected phone
Commands in some of the Monokle samples Lookout researchers analyzed lead them to believe that there may be versions of Monokle developed for devices running Apple’s iOS. Unused in the Android samples, the commands were likely added unintentionally. The commands controlled iOS functions for the keychain, iCloud connections, Apple Watch accelerometer data, iOS permissions, and other iOS features or services. Lookout researchers didn’t find any iOS samples, but they believe iOS versions may be under development. Monokle gets its name from a malware component a developer titled "monokle-agent."
Read 10 remaining paragraphs | Comments
Read More