Remote (and silent) install an Android application. Where is the true ?

[marcick]

Hi all,

for sure there are here experts that have a deep knowledge of Android system and not only good B4A developers.

I have developed a simple application to remotely track the position of Android devices. My customers are private investigators and often they need to track people besides vehicles. I’m talking about legal investigations with all the needed authorizations. Typical case is a family that have suspect something is not going in the right direction and want to see what their young son does in the evening, which places it frequent, etc.

Of course, they must have in hands the destination device for a couple of minutes to install this spy application, as for any other application.

I saw on Tv some reportage, they were talking about security and privacy issues using a mobile device. An “expert” technician showed as he sent a message to the destination device and just clicking on it (I suppose a web link) a spy application was installed. No user interaction, no warnings, no privileges to accept, nothing of nothing. The device was infected, and they showed how they were able to do everything: log calls, download picture, SMS, ect. As if they had the device in their hands.

I always thought it is a fake and this is not possible, considering how Android is severe about security stuff. But people believe this. My customers ask me.

I’m not really interested to learn hacking methods to obtain a silent remote install, if they exist. This is my job and I must keep my shoes inside what is allowed by law. But for my culture I would like to know how the things really are and be able to give the proper answer. The answer of an expert as they see me.

So, the question is: is it really possible to remotely infect an Android device with a malware, backdoor, so that any kind of application can be installed, and the user see nothing?

Or is it really a fake?

 

[alwaysbusy]

*maybe* on Android 5 or below, but for all versions above I doubt (and seriously hope) this is not possible without showing the permissions window for anything 'dangerous' like camera, contacts, sms, etc...

 

[marcick]

A variant to the question: suppose the app does not require any permission. Can it be remotely installed without the user realize it ? Just cllicking a curious link for example ?

 

[Erel]

I'm sure that some of the reports are real. However it is not something that can be done without exploiting an OS bug (on normal Android devices).

 

[marcick]

I still want to unbelieve. Can a "link click" execute something and modify something in the Android system ?
In Windows yes, we know, but is Android OS open to this also ?

 

[DonManfred]

Can a "link click" execute something and modify something in the Android system ?

Kind of, yes. But expected. For example you can use firebase Invite to invite a friend to install your app. The user gets an email with a Link. If the app is already installed on his device the app is started with the data containing in the Invitelink which is a Dynamiclink.
The app can extract the extra data from the starting intent...

If the app is not installed on his device he gets forwarded to the playstore to install your app.

This is using regular and official Apis.

 

[marcick]

DonManfred, what YOU say requires a strong and aware user interaction and of course the app is not already installed.
What THEY say is much different. The user receive a link inside a message that invite to something of interesting, let's say "black Friday on Amazon". He click the link and ... Puff. ! The device is infected and they have full control of it, like if a program like "Cerberus" has been installed without the user know it.
This is what I can't believe but many people do.
I can try to find that reportage on internet and show you the video (but it's in Italian language).

 

[DonManfred]

The device is infected and they have full control of it, like if a program like "Cerberus" has been installed without the user know it.
This is what I can't believe but many people do.

i can´t believe it too.

but it's in Italian language

i do not understand. No need.

 

[marcick]

I don't know if you can access here outside of Italy, but this is the link to the reportage.
At the beginning there is an interview in English.
Then I think that just watching you can understand what they talk about

https://www.iene.mediaset.it/video/viviani-e-se-ti-spiassero-dal-tuo-cellulare-_68914.shtml

 

[udg]

I agree with Erel. A silent installation from a link disguised as a friendly message (SMS or whatever) could be possible only leveraging a bug or a backdoor in the OS.
It could be easier when the attacked device is rooted. BTW, the "secret" could be that it exists a way to make a regular device rooted w/o user intervention.
Probably the attacker injects a script which downloads and execute the malaware. A similar action could be used to remove the malaware once it's no more needed.

Just my 2c

 

[marcick]

Any of you was able to see the video ? At the beginning there is an interview in English.
Totally fake ?

 

[rabbitBUSH]

Any of you was able to see the video ? At the beginning there is an interview in English.
Totally fake ?

Its called Stalkerware

although there is no indication about how this software gets onto your phone (except for a comment at the end of the clip) this is a BBC Click programme video I saw on the BBC World News (satellite channel) [note to @DonManfred > english language] :

https://www.bbc.com/news/technology-50166147
there is also a comment at the end about leaving your phone unattended, so one of the ways this gets onto your phone is your parents have access to the phone, your partner, a friend, a colleague, at some time for a enough time to install it (invloving so many attendant issues about trust relationships between partners, parents, children etc.)- other than that, @Erel suggests it non-trivial to do.

The text article with the video has several links to information about Stalkerware from Kaspersky. Joe Tidy > the journalist tells you in the text where he obtained the software and the cost, its categorised as surveillance (as your clients are interested in). I guess sometimes we just have creepy clients its creepy that this software exists in the world.

a friend of mine has a school friend who works for the local spooks. i was told that this person arrived at lunch. would not greet my friend until the battery from the phone was removed and the phone placed on the table - the claim being that even with the phone turned off it could be tracked and located even used as a listening device by the bosses, hence removing the battery - but, then, this is a phone linked to an employer in national security - the person does work there - whether the claim is true or just paranoia - ???

Incidentally, the english part of the interview in your clip is with Edward Norton who worked for the American NSA - google what that organisation has been in trouble for over the past years - but then you have to have the USA govt behind you - I'm told the Israeli's are quite good at this too - but us little guys would have to work quite hard or get lucky without big resources ....

Basically, seems its possible, maybe not easy as a payload like a virus or phishware, probably illegal, definitely anti-social but judge for yourself if its fake or not..........watch the video