Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Suppose my smartphone has been compromised and there is malicious software running on it. You can assume that the malicious software has broken out of any sandboxes and is running as root.

If I'm on a phone call, can the malicious software change what I'm hearing? Can it modify the audio of the phone call? In other words, can it mount a man-in-the-middle attack on the audio channel of a phone call that I place from my smartphone or that I receive on my smart phone?

Also, can the malicious software eavesdrop on the phone call, i.e., can it record the audio of the entire call?

I realize this might be a little bit "science-fiction-y". Still, I'm interested in whether it is possible, even in principle. Or is there some fundamental barrier that would make it difficult or impossible for an attacker who has compromised the software on my smartphone to mess with my phone calls like this?

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

Yes, the "phone" itself is an application. It can be hijacked or replaced entirely. In fact, Android handsets are DESIGNED to do this so that you can automatically use a VOIP provider when making phone calls if you so desire. Malware with complete device control could simply place itself as such a service and when you dialed a call, it would be connected through VOIP and the attacker.

Even without doing this, the microphone and speaker are also controlled by software and there isn't any reason that it couldn't record the input and output from there either if it has sufficient privileges to the system.

share|improve this answer
    
Are you sure? Can you elaborate on how this works, what permissions are required, and what APIs would be used? I've researched this a bit further, and it looks like third-party apps (such as VOIP apps) are able to intercept outgoing calls, but not incoming calls. In particular, if you have the PROCESS_OUTGOING_CALLS permission, you'll be notified of all outgoing calls and can block them. However, in recent versions of Android, there appears to be no way to programmatically answer an incoming call and tamper with the audio stream. What have I missed? –  D.W. Jan 30 at 22:55
    
As far as software control of the microphone and speaker: can you elaborate? Are the microphone/speaker controlled by the application CPU, or by the modem/baseband chip? There's software, and then there's software. A lot of the telephony stuff is controlled by the baseband/modem chip, which I believe is harder to penetrate than the application CPU (apps run on the application CPU). I don't know phone architecture well enough to know what controls the speaker and microphone. Do you know how that works, well enough to say whether an app can do a MITM attack on speaker and microphone data? –  D.W. Jan 30 at 22:58
    
Another way to ask this would be: Do you know of any demonstration exploit, and how does it work? What you say seems like it could be plausible, but it would be interesting to actually see it done to confirm whether this kind of attack is truly possible -- and on what devices it does/doesn't work on. –  D.W. Jan 30 at 23:02
    
@D.W. there are different dialers provided by different manufacturers. The actual connection to the cell network is done through the radio, but the speaker and mic run through Android and the CPU. I know there are replacement dialers that you can install, though I'm not sure how deep of access is needed. It might require actually replacing kernel components, but that is theoretically possible if you are rooted and the bootloader is unlocked. –  AJ Henderson Jan 30 at 23:59
    
OK. I wonder if this is still possible if the phone is not rooted and the boot loader is not unlocked. I wonder what is possible. Sounds like it might make a good project to try to work out to what extent of a threat there is. –  D.W. Jan 31 at 0:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.