System Information Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, and architecture.
On Android, much of this information is programmatically accessible to applications through the android.os.Build class.[1]
On iOS, techniques exist for applications to programmatically access this information.[2]
Procedure Examples
| Name | Description |
|---|---|
| Android/Chuli.A |
Android/Chuli.A gathered system information including phone number, OS version, phone model, and SDK version.[3] |
| ANDROIDOS_ANSERVER.A |
ANDROIDOS_ANSERVER.A gathers the device OS version, device build version, manufacturer, and model.[4] |
| Anubis | |
| Cerberus |
Cerberus can collect device information, such as the default SMS app and device locale.[6][7] |
| Corona Updates |
Corona Updates can collect various pieces of device information, including OS version, phone model, and manufacturer.[8] |
| Desert Scorpion |
Desert Scorpion can collect device metadata and can check if the device is rooted.[9] |
| Dvmap |
Dvmap checks the Android version to determine which system library to patch.[10] |
| eSurv | |
| EventBot |
EventBot can collect system information such as OS version, device vendor, and the type of screen lock that is active on the device.[12] |
| FakeSpy |
FakeSpy can collect device information, including OS version and device model.[13] |
| GolfSpy |
GolfSpy can obtain the device’s battery level, network operator, connection information, sensor information, and information about the device’s storage and memory.[14] |
| Gustuff |
Gustuff gathers information about the device, including the default SMS application, if SafetyNet is enabled, the battery level, the operating system version, and if the malware has elevated permissions.[15] |
| INSOMNIA |
INSOMNIA can collect the device’s name, serial number, iOS version, total disk space, and free disk space.[16] |
| KeyRaider |
Most KeyRaider samples search to find the Apple account's username, password and device's GUID in data being transferred.[17] |
| Mandrake |
Mandrake can access device configuration information and status, including Android version, battery level, device model, country, and SIM operator.[18] |
| Monokle |
Monokle queries the device for metadata such as make, model, and power levels.[19] |
| Pallas |
Pallas queries the device for metadata, such as device ID, OS version, and the number of cameras.[20] |
| Pegasus for iOS |
Pegasus for iOS monitors the victim for status and disables other access to the phone by other jailbreaking software.[21] |
| RedDrop |
RedDrop exfiltrates details of the victim device operating system and manufacturer.[22] |
| Riltok |
Riltok can query various details about the device, including phone number, country, mobile operator, model, root availability, and operating system version.[23] |
| Rotexy |
Rotexy collects information about the compromised device, including phone number, network operator, OS version, device model, and the device registration country.[24] |
| RuMMS |
RuMMS gathers device model and operating system version information and transmits it to a command and control server.[25] |
| TrickMo |
TrickMo can collect device information such as network operator, model, brand, and OS version.[26] |
| ViceLeaker |
ViceLeaker collects device information, including the device model and OS version.[27] |
| ViperRAT |
ViperRAT can collect system information, including brand, manufacturer, and serial number.[28] |
| XLoader for Android |
XLoader for Android collects the device’s Android ID and serial number.[29] |
| XLoader for iOS |
XLoader for iOS can obtain the device’s UDID, version number, and product number.[29] |
Mitigations
| Mitigation | Description |
|---|---|
| Application Vetting |
App vetting procedures can search for apps that use the android.os.Build class, but these procedures could potentially be evaded and are likely not practical in this case, as many apps are likely to use this functionality as part of their legitimate behavior. |
References
- Android. (n.d.). Build. Retrieved December 21, 2016.
- Stack Overflow. (n.d.). How can we programmatically detect which iOS version is device running on?. Retrieved December 21, 2016.
- Costin Raiu, Denis Maslennikov, Kurt Baumgartner. (2013, March 26). Android Trojan Found in Targeted Attack. Retrieved December 23, 2016.
- Karl Dominguez. (2011, September 27). ANDROIDOS_ANSERVER.A. Retrieved November 30, 2018.
- M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved April 8, 2020.
- Threat Fabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved June 26, 2020.
- A. Hazum, B. Melnykov, C. Efrati, D. Golubenko, I. Wernik, L. Kuperman, O. Mana. (2020, April 29). First seen in the wild – Malware uses Corporate MDM as attack vector. Retrieved June 26, 2020.
- T. Bao, J. Lu. (2020, April 14). Coronavirus Update App Leads to Project Spy Android and iOS Spyware. Retrieved April 24, 2020.
- A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020.
- R. Unuchek. (2017, June 8). Dvmap: the first Android malware with code injection. Retrieved December 10, 2019.
- A. Bauer. (2019, April 8). Lookout discovers phishing sites distributing new iOS and Android surveillanceware. Retrieved September 11, 2020.
- D. Frank, L. Rochberger, Y. Rimmer, A. Dahan. (2020, April 30). EventBot: A New Mobile Banking Trojan is Born. Retrieved June 26, 2020.
- O. Almkias. (2020, July 1). FakeSpy Masquerades as Postal Service Apps Around the World. Retrieved September 15, 2020.
- E. Xu, G. Guo. (2019, June 28). Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.
- Vitor Ventura. (2019, April 9). Gustuff banking botnet targets Australia . Retrieved September 3, 2019.
- I. Beer. (2019, August 29). Implant Teardown. Retrieved June 2, 2020.
- Claud Xiao. (2015, August 30). KeyRaider: iOS Malware Steals Over 225,000 Apple Accounts to Create Free App Utopia. Retrieved December 12, 2016.
- R. Gevers, M. Tivadar, R. Bleotu, A. M. Barbatei, et al.. (2020, May 14). Uprooting Mandrake: The Story of an Advanced Android Spyware Framework That Went Undetected for 4 Years. Retrieved July 15, 2020.
- Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.
- Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.
- Lookout. (2016). Technical Analysis of Pegasus Spyware. Retrieved December 12, 2016.
- Nell Campbell. (2018, February 27). RedDrop: the blackmailing mobile malware family lurking in app stores. Retrieved September 18, 2018.
- Tatyana Shishkova. (2019, June 25). Riltok mobile Trojan: A banker with global reach. Retrieved August 7, 2019.
- T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.
- Wu Zhou, Deyu Hu, Jimmy Su, Yong Kang. (2016, April 26). RUMMS: THE LATEST FAMILY OF ANDROID MALWARE ATTACKING USERS IN RUSSIA VIA SMS PHISHING. Retrieved February 6, 2017.
- P. Asinovsky. (2020, March 24). TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany. Retrieved April 24, 2020.
- GReAT. (2019, June 26). ViceLeaker Operation: mobile espionage targeting Middle East. Retrieved November 21, 2019.
- M. Flossman. (2017, February 16). ViperRAT: The mobile APT targeting the Israeli Defense Force that should be on your radar. Retrieved September 11, 2020.
- Hiroaki, H., Wu, L., Wu, L.. (2019, April 2). XLoader Disguises as Android Apps, Has FakeSpy Links. Retrieved July 20, 2020.