Embedded Mobile Malware — The greatest cyber weapon
By: Josue Martins
Tags: Cybersecurity, Attack, Privacy, Espionage, Gdpr

The cybersecurity and enterprise world have deep knowledge of attacks towards computers and servers running Linux or windows but not towards mobile operating systems such as Android and iOS and others.

In the digital era, most people use their smartphone to browse the internet, and bring your own device has become the norm in the workplace, but these smart devices are the victims of embedded malware developed by skilled hackers, who are willing to extract as much as information for their own financial benefit.

Most of the mobile malware creators are interested in the following information from your smartphone:

MSISDN/telephone number International Mobile Subscriber Identity/IMSI IMEI Email Address List of software installed in your smartphone SMS(Messages) to read your Transfer authorization numer(TAN) or One time password(OTP) Location Passwords Documents and other personal information Credit card numbers Administrator access or privileges in the smartphones.

Pieces of information that are extracted by an embedded malware

The above information is critical for cybercriminals to conduct all orchestrated attacks and the common types of attacks that can be conducted with the above information are:

- Account take over - Financial fraud - Espionage such as location extraction, interception of calls and all texts messages towards the device - Telecommunications fraud - Selling Information of users in the Darkweb or Marketing companies - Botnets

Account take over

By collecting all the above information by using an embedded mobile malware, the attacker can use the information in the following way.

Request a password request from your yahoo or email account and choosing the verification by a telephone number(MSISDN), extracted by the malware too.

Google verification code, which can be read by an embedded malware

Using the vulnerabilities in the SS7(Map ) protocol the attacker can intercept your SMS and insert it in the two-factor authentication input field in the website host your email address.

Two-factor authentification with Telephone number

Financial fraud

Once a cybercriminal has the information needed to perform an account take over as explained in Account over, the cybercriminal can then proceed into transferring funds from one account to another or even extract credit card numbers to purchase goods online or sell the credit numbers on the Darkweb.

Cybercriminals normally also lock you out of all your devices to prevent you from calling your bank once your financial information has been sold or used by them.

Espionage

There are various ways that an individual can be spied on.

The most common methods being used are :

Signaling Attacks

Signaling attacks are performed by sending signaling messages from one mobile network to another to extract sensitive information from the mobile user connected to a mobile operator network.

SS7(MAP) Any Time Interrogation and Provide Subscribers Information to extract the location of the user in a mobile network.

SS7 (MAP) RegisterSS and other MAP messages to intercept the voice call or SMS.

Silent SMS can also be used to extract the location of a subscriber and other vulnerabilities such as the SimJacker.

SS7 vulnerabilities reported by BBC News

These methods might not be as efficient as in the past due to the fact that many mobile operators are deploying a Signalling firewall to block these messages from malicious actors.

SS7 attacks for sale on the dark web

SS7 attacks for sale in the dark web and payment is done with bitcoins

Mobile Malware

Using mobile malware is a very good method because it extracts GPS coordination of the device has the victim moves around and it is accurate as the signaling attacks and the mobile operators are not actively blocking them.

The use of mobile malware is also very active to cybercriminals because the normal smartphone users do not install antivirus solution and mobile malware can offer more that is why is the greatest weapon in by security.

The most advanced mobile malware has the following features.

Recording audio and video live without the knowledge of the end user. Intercepting Text,Calls and other social media software contents. Provide full remote control of the device to the attacker. Read the notification in the smartphone. Extract location of the device continuosly in realtime or not. Installing new malware on the devices.

The application called Mobile Tracker Free https://mobile-tracker-free.com/ are used for this purposes and it very cheap with a great user interface.

Malware extracting the location of the user

The exact location of the user extracted by the malware

Telecommunications fraud

Apart from mobile malware being a great weapon to extract sensitive information from a smartphone, it can also be used to commit telecommunication fraud.

The most common are known as international revenue-sharing fraud.

Malware can have an SMS feature that sends SMS to or even make calls to international numbers without the knowledge of the smartphone user, most of these international numbers are associated with high charging fees.