Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to learn how to write and Android application that can detect a run time spy application. In this instance, a "spy application" is a background application that uses the camera, microphone and other important device.

How can I detect which background application is using the camera, microphone or GPRS?

share|improve this question
    
Do you classify spy applications as only background apps that are accessing microphone, camera, and gps/location services? If that is the only restriction it's should probably be possible. –  dudebrobro Aug 8 '13 at 15:47
    
Indeed my question cover all of them(cam, mic, gprs, contact list), which all accessing without my knowledge. But you can answer only camera or mic. –  Goshawk Aug 8 '13 at 15:55

2 Answers 2

You could write an app to try and monitor what's happening on the device, but it would require elevated permissions for your app like running as System or requesting a large set of permissions, so that you could query the appropriate services and access system resources to guess at what other apps are doing. The packagemanager exposes api calls for determining the installed applications and even examining their permissions, At best though like mentioned in the earlier answer all apps run in their own instance of the dalvik vm. Access to resources on the system are also restricted by permissions both DAC and capabilities (in 4.3). Examining permissions or trying to see what apps are doing would be difficult, especially in the case of malicious apps that abuse poorly written legitimate apps

Even Google's measures for detecting malicious apps aren't foolproof though this quote is from a presentation at defcon

In another bit of disturbing news related to Young’s research is the ability of an explicitly malicious app to get into the Google Play store and hang around for a while. According to reports, Young created an app to test the vulnerability and uploaded it to the Google Play store where it was clearly marked as malicious and users were warned not to install it. During the month it was available, until a user reported it, Google’s Bouncer service did not flag it as malicious. It is not clear whether the app was ever scanned by Bouncer or whether it “passed” the scan, but neither option reflects well on Bouncer’s effectiveness. Young also reported that most antivirus products for Android devices failed to detect the app as being malware, though one unnamed privacy application flagged it as having account access.

Modifying the platform would be the best way to try and detect malicious apps. SE for Android is project aimed at adding security and MAC to the android platform some of the concepts that they are exploring might be of interest.

share|improve this answer

On an unrooted android device, apps run within their own container. Google performs security checks on all apps using Bouncer. Based on this combination of security measures, Anti-malware android apps are totally useless.

I think the most interesting research in spyware detection on android is led by Penn State and Duke University which culminated in TaintDroid. This is a modified version of android where function calls are hooked to track the flow of personal information though a potentiality malicious app. This is not an app running within a restrictive sandbox, but rather a modification to the platform.

If you are interested in detecting spyware on android, you should install TaintDroid and then explore some shady apps.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.