Location Tracking
An adversary could use a malicious or exploited application to surreptitiously track the device's physical location through use of standard operating system APIs.
Procedure Examples
| Name | Description |
|---|---|
| Adups | |
| Android/Chuli.A |
Android/Chuli.A stole geo-location data.[2] |
| AndroRAT | |
| Anubis | |
| Cerberus | |
| Charger |
Charger checks the local settings of the device and does not run its malicious logic if the device is located in Ukraine, Russia, or Belarus.[6] |
| Corona Updates |
Corona Updates can track the device’s location.[7] |
| Desert Scorpion |
Desert Scorpion can track the device’s location.[8] |
| eSurv | |
| Exodus |
Exodus Two can extract the GPS coordinates of the device.[10] |
| FinFisher |
FinFisher tracks the latitude and longitude coordinates of the infected device.[11] |
| FlexiSpy | |
| GolfSpy | |
| INSOMNIA | |
| Mandrake | |
| Monokle | |
| Pallas |
Pallas tracks the latitude and longitude coordinates of the infected device.[11] |
| Pegasus for iOS |
Pegasus for iOS update and sends the location of the phone.[17] |
| PJApps |
PJApps has the capability to collect and leak the victim's location.[3] |
| RCSAndroid |
RCSAndroid can record location.[18] |
| Skygofree | |
| SpyDealer | |
| SpyNote RAT |
SpyNote RAT collects the device's location.[21] |
| Stealth Mango |
Stealth Mango can perform GPS location tracking as well as capturing coordinates as when an SMS message or call is received.[22] |
| Tangelo |
Tangelo contains functionality to gather GPS coordinates.[22] |
| ViceLeaker |
ViceLeaker can collect location information, including GPS coordinates.[23][24] |
| ViperRAT | |
| X-Agent for Android |
X-Agent for Android was believed to have been used to obtain locational data of Ukrainian artillery forces.[26] |
Mitigations
| Mitigation | Description |
|---|---|
| Application Vetting |
On Android, applications must request the ACCESS_COARSE_LOCATION or ACCESS_FINE_LOCATION permission to access the device's physical location. Extra scrutiny could be given to applications that request these permissions. On iOS, calls to the relevant APIs could be detected during the vetting process. |
Detection
On both Android (6.0 and up) and iOS, the user can view which applications have permission to access device location through the device settings screen, and the user can choose to revoke the permissions.
References
- Matt Apuzzo and Michael S. Schmidt. (2016, November 15). Secret Back Door in Some U.S. Phones Sent Data to China, Analysts Say. Retrieved February 6, 2017.
- Costin Raiu, Denis Maslennikov, Kurt Baumgartner. (2013, March 26). Android Trojan Found in Targeted Attack. Retrieved December 23, 2016.
- Lookout. (2016, May 25). 5 active mobile threats spoofing enterprise apps. Retrieved December 19, 2016.
- M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved April 8, 2020.
- Threat Fabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved June 26, 2020.
- Oren Koriat and Andrey Polkovnichenko. (2017, January 24). Charger Malware Calls and Raises the Risk on Google Play. Retrieved January 24, 2017.
- T. Bao, J. Lu. (2020, April 14). Coronavirus Update App Leads to Project Spy Android and iOS Spyware. Retrieved April 24, 2020.
- A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020.
- A. Bauer. (2019, April 8). Lookout discovers phishing sites distributing new iOS and Android surveillanceware. Retrieved September 11, 2020.
- Security Without Borders. (2019, March 29). Exodus: New Android Spyware Made in Italy. Retrieved September 3, 2019.
- Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.
- Actis B. (2017, April 22). FlexSpy Application Analysis. Retrieved September 4, 2019.
- E. Xu, G. Guo. (2019, June 28). Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.
- I. Beer. (2019, August 29). Implant Teardown. Retrieved June 2, 2020.
- R. Gevers, M. Tivadar, R. Bleotu, A. M. Barbatei, et al.. (2020, May 14). Uprooting Mandrake: The Story of an Advanced Android Spyware Framework That Went Undetected for 4 Years. Retrieved July 15, 2020.
- Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.
- Lookout. (2016). Technical Analysis of Pegasus Spyware. Retrieved December 12, 2016.
- Veo Zhang. (2015, July 21). Hacking Team RCSAndroid Spying Tool Listens to Calls; Roots Devices to Get In. Retrieved December 22, 2016.
- Nikita Buchka and Alexey Firsh. (2018, January 16). Skygofree: Following in the footsteps of HackingTeam. Retrieved September 24, 2018.
- Wenjun Hu, Cong Zheng and Zhi Xu. (2017, July 6). SpyDealer: Android Trojan Spying on More Than 40 Apps. Retrieved September 18, 2018.
- Shivang Desai. (2017, January 23). SpyNote RAT posing as Netflix app. Retrieved January 26, 2017.
- Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018.
- GReAT. (2019, June 26). ViceLeaker Operation: mobile espionage targeting Middle East. Retrieved November 21, 2019.
- L. Arsene, C. Ochinca. (2018, August 20). Triout – Spyware Framework for Android with Extensive Surveillance Capabilities. Retrieved January 21, 2020.
- M. Flossman. (2017, February 16). ViperRAT: The mobile APT targeting the Israeli Defense Force that should be on your radar. Retrieved September 11, 2020.
- CrowdStrike Global Intelligence Team. (2016). Use of Fancy Bear Android Malware in Tracking of Ukrainian FIeld Artillery Units. Retrieved February 6, 2017.