Skip to main content
Information Security

Return to Question

Tweeted twitter.com/#!/StackSecurity/status/604112144771215360
added 249 characters in body
Source Link
schroeder ♦
schroeder ♦
  • 132.1k
  • 55
  • 307
  • 348

I caught a segment of an NBC news story describing how hackers can access messages, phone conversations, location, camera, microphone, and more provided that they can install a malicious app on your Android device.

In the video, the cyber security expert gets the correspondent to click on one link on his phone and then tells him he's compromised. Two questions:

  1. How could someone be compromised that quickly by merely clicking on a link? Don't modern browsers prevent any sort of app from being installed without asking the user first? Is there some JavaScript exploit at play here?

  2. How is an Android app able to access so much of this information anyway (provided that it's installed)? I take it that the only way to access these resources (be it messages, hardware, whatever) is through the standard Android SDK, and that the OS would prevent complete and open access to those resources without the user permission.

Summary of Video:
James Lyne, Sophos Global

James shows a complete RATting of an Android phone by simply clicking a link. It is explained that this is possible if the user allows the installing of apps from outside Google Play.

I caught a segment of an NBC news story describing how hackers can access messages, phone conversations, location, camera, microphone, and more provided that they can install a malicious app on your Android device.

In the video, the cyber security expert gets the correspondent to click on one link on his phone and then tells him he's compromised. Two questions:

  1. How could someone be compromised that quickly by merely clicking on a link? Don't modern browsers prevent any sort of app from being installed without asking the user first? Is there some JavaScript exploit at play here?

  2. How is an Android app able to access so much of this information anyway (provided that it's installed)? I take it that the only way to access these resources (be it messages, hardware, whatever) is through the standard Android SDK, and that the OS would prevent complete and open access to those resources without the user permission.

I caught a segment of an NBC news story describing how hackers can access messages, phone conversations, location, camera, microphone, and more provided that they can install a malicious app on your Android device.

In the video, the cyber security expert gets the correspondent to click on one link on his phone and then tells him he's compromised. Two questions:

  1. How could someone be compromised that quickly by merely clicking on a link? Don't modern browsers prevent any sort of app from being installed without asking the user first? Is there some JavaScript exploit at play here?

  2. How is an Android app able to access so much of this information anyway (provided that it's installed)? I take it that the only way to access these resources (be it messages, hardware, whatever) is through the standard Android SDK, and that the OS would prevent complete and open access to those resources without the user permission.

Summary of Video:
James Lyne, Sophos Global

James shows a complete RATting of an Android phone by simply clicking a link. It is explained that this is possible if the user allows the installing of apps from outside Google Play.

Source Link
John V
John V
  • 63
  • 1
  • 4

How easy is it for hackers to gain unauthorized access to resources on an Android phone?

I caught a segment of an NBC news story describing how hackers can access messages, phone conversations, location, camera, microphone, and more provided that they can install a malicious app on your Android device.

In the video, the cyber security expert gets the correspondent to click on one link on his phone and then tells him he's compromised. Two questions:

  1. How could someone be compromised that quickly by merely clicking on a link? Don't modern browsers prevent any sort of app from being installed without asking the user first? Is there some JavaScript exploit at play here?

  2. How is an Android app able to access so much of this information anyway (provided that it's installed)? I take it that the only way to access these resources (be it messages, hardware, whatever) is through the standard Android SDK, and that the OS would prevent complete and open access to those resources without the user permission.