Snippet 23: Malicious Applications Leveraging RC Interfaces

An Android vulnerability let a malicious app reach the camera and microphone without user approval, but the bigger lesson is permission sprawl: dozens of apps routinely hold microphone access, and paired Bluetooth peripherals extend those microphones into places a phone cannot go.

Key Takeaways

• A malicious app can turn a phone into a spying device by subverting, or simply being granted, microphone and camera permissions
• Permission sprawl is normal: dozens of apps request microphone access and users routinely allow it
• Paired Bluetooth peripherals such as watches and headsets act as remote microphones for any app with mic access, even while the phone sits in a locker
• Researchers have inferred PIN entry from microphone vibration data at roughly fifty percent accuracy

Video Transcript

This one's a little bit different attack. And it's more about exploiting a device, and then leveraging Bluetooth downstream. It's an Android app, CVE, where the researchers showed that they could get camera or microphone access on Android by subverting the user verification. So they could put an app on your phone that could get access to your microphone and your camera without asking you about it. And so once you have that access, they show that they are able to stream images, and video, and audio without the user even knowing about it.

They didn't get into the details of how that worked, but they said the Android intents and actions request workflow had some hole in it. That's the code that an app developer uses to request this peripheral access. So basically, there was a problem there. But the net result is that a malicious app can turn a phone into a spying device. So that actually got me thinking, let me check my phone. And maybe exquisite attacks that subvert permissioning is not required.

So I looked at my permission manager on my Android phone, and sure enough, I've got 55 apps that want to use my microphone. I've let 27 of them do that. And similarly high numbers for cameras. And you look at the list, and you're wondering, LIFX is my Wi-Fi light bulbs in my house. I'm not sure why they need my microphone. But it just goes to show me, and I have some pretty strict security hygiene. And I'm pretty meticulous about what apps I let on my phone.

I've got apps that have microphone access that you might not want to have microphone access. So it's not hard to imagine a user who's not very rigorous, allowing microphone access to essentially a rogue app that could use that microphone access to tap an environment. What makes this kill chain maybe more interesting still is, if you think about a user who works in a restricted area, and they have their phone and they leave it in the locker.

But they forget to take their smartwatch that has a microphone on it, or their Bluetooth headset that has a microphone on it, off. Or they leave it in their bag, and those devices are still paired to the phone that's in the locker. A malicious app that has microphone access, also has access to your remote microphones. So any of your Bluetooth connected peripherals, any of these apps can listen to that microphone as well. I'm slowly tying this back to Bluetooth, if you guys didn't notice.

That becomes a Bluetooth threat vector now, because now I'm using my Bluetooth remote microphone to exfiltrate audio and video, or at least audio from my phone to anywhere in the world that's networked with the phone. Just as a funny aside, as I was researching these, there's another vulnerability that some researchers found that they could use the microphones. So if they get access to the microphones, they were able to infer your PIN number, based on the vibrations and the sounds that induced in the microphone.

They were able to do that with a 50% rate of accuracy.