On Android, details of onboard network interfaces are accessible to apps through the java.net.NetworkInterface class.^[1] The Android TelephonyManager class can be used to gather related information such as the IMSI, IMEI, and phone number.^[2]

On iOS, gathering network configuration information is not possible without root access.

ID: T1422

Sub-techniques: No sub-techniques

Tactic Type: Post-Adversary Device Access

Tactic: Discovery

Platforms: Android, iOS

Version: 2.1

Created: 25 October 2017

Last Modified: 02 June 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
ANDROIDOS_ANSERVER.A	ANDROIDOS_ANSERVER.A gathers the device IMEI and IMSI.^[3]
Bread	Bread collects the device’s IMEI, carrier, mobile country code, and mobile network code.^[4]
Corona Updates	Corona Updates can collect device network configuration information, such as Wi-Fi SSID and IMSI.^[5]
DualToy	DualToy collects the connected iOS device’s information including IMEI, IMSI, ICCID, serial number and phone number.^[6]
EventBot	EventBot can gather device network information.^[7]
Exodus	Exodus One queries the device for its IMEI code and the phone number in order to validate the target of a new infection.^[8]
FakeSpy	FakeSpy can collect device networking information, including phone number, IMEI, and IMSI.^[9]
Gustuff	Gustuff gathers the device IMEI to send to the command and control server.^[10]
INSOMNIA	INSOMNIA can collect the device’s phone number, ICCID, IMEI, and the currently active network interface (Wi-Fi or cellular).^[11]
Monokle	Monokle checks if the device is connected via Wi-Fi or mobile data.^[12]
Pegasus for Android	Pegasus for Android checks if the device is on Wi-Fi, a cellular network, and is roaming.^[13]
Pegasus for iOS	Pegasus for iOS monitors the connection state and tracks which types of networks the phone is connected to, potentially to determine the bandwidth and ability to send full data across the network.^[14]
PJApps	PJApps has the capability to collect and leak the victim's phone number, mobile device unique identifier (IMEI).^[15]
RedDrop	RedDrop collects and exfiltrates information including IMEI, IMSI, MNC, MCC, nearby Wi-Fi networks, and other device and SIM-related info.^[16]
Riltok	Riltok can query the device's IMEI.^[17]
Rotexy	Rotexy collects the device's IMEI and sends it to the command and control server.^[18]
RuMMS	RuMMS gathers the device phone number and IMEI and transmits them to a command and control server.^[19]
SpyDealer	SpyDealer harvests the device phone number, IMEI, and IMSI.^[20]
Stealth Mango	Stealth Mango collects and uploads information about changes in SIM card or phone numbers on the device.^[21]
Tangelo	Tangelo contains functionality to gather cellular IDs.^[21]
TrickMo	TrickMo can collect device network configuration information such as IMSI, IMEI, and Wi-Fi connection state.^[22]
ViperRAT	ViperRAT can collect network configuration data from the device, including phone number, SIM operator, and network operator.^[23]
WolfRAT	WolfRAT sends the device’s IMEI with each exfiltration request.^[24]
XLoader for Android	XLoader for Android collects the device’s IMSI and ICCID.^[25]
XLoader for iOS	XLoader for iOS can obtain the device’s IMEM, ICCID, and MEID.^[25]

Mitigations

Mitigation	Description
Application Vetting	Application vetting could be used to analyze applications to determine whether they access this information, including determining whether the application requests the Android ACCESS_NETWORK_STATE permission (required in order to access NetworkInterface information) or the READ_PHONE_STATE permission (required in order to access TelephonyManager information).
Use Recent OS Version	Starting in Android 6.0, applications can no longer access MAC addresses of network interfaces.^[26]

System Network Configuration Discovery

Procedure Examples

Mitigations

References