1

As background, my business bank account was compromised. The compromise also involved call forwarding of a smartphone. So they got bank credentials and cell phone credentials.

I initially suspected key-loggers on compromised laptops, compromised networking equipment at home or office, or social engineering. But it finally dawned on me that my Android phone was another possible source for the breach.

Last night, using an Android network scanner, I scanned my home network and saw that my Droid Turbo had two services running, one for Port 4000 and I believe the other was Port 4500. Port 4000 was "Remote Anything slave" and a quick Google let me know that this gives a hacker complete control of my device. Other Android phones in the family did not have these services running. I quickly shut the phone down and am going to buy a new phone this morning.

My assumption at this point is that the phone hack allowed them to get my cell phone company passcode that allowed them to forward bank activation codes; the bank and phone company confirm this happened.

I guess my question is whether every computer and phone on my networks (business and home) are now likely to have malware? From the phone, can the malware go to the router and then go put malware on other devices. Is there likely to be malware on the router? I'm trying to understand what needs to be replaced. I should add that I don't recall going to the bank website on my cell phone but it's possible. I don't have the bank app but I might have logged in on the train ride home to do something.

Any and all advice is appreciated. Surprisingly, the bank, the cell phone company and Google don't seem all that interested in investigating, so I guess I am on my own.

  • What did you find out about the "Remote Anything slave"? Please provide any links and relevant quotes so that readers don't have to reinvent the wheel. – Jan Doggen Mar 7 '16 at 16:19
  • All I found were pages that had hackers and government officials talking about it being a goldmine for hacking. These pages were on sketchy sites, so I don't think you want me linking to them here, but Google will get you to them quickly. You may have to view cached versions of the pages. Sorry I can't be more helpful. – user1883779 Mar 7 '16 at 17:23
1

Stuff like this happens everyday. It's not a surprise that any of the companies don't want to investigate. It's too small of a scale and not in their best interest to do so. Now as for your questions...

  • Network Devices: Home/consumer network devices are typical not kept as secure or firmware updates released as often for. The best thing to do would be to check the manufacturer's website of your router/AP/switch to see if you're running the latest firmware. A hard/factory reset of the device would be prudent. While it's unlikely that the malware on the phone was able to infect your router in any way, it's not impossible. Also, if your home router allows you to implement policies, consider blocking unnecessary outbound traffic. This can deter malware applications from reaching their host if they are not using a default http/https port.
  • Other computers/phones: You should start by changing Administrator passwords on each device and running full AV scans. If you use any cloud-based file sharing services (i.e.- Google Drive, Dropbox, etc.) you'll want to scan those as well. Certainly try and target the services you used on your infected phone first. Any accounts that were tied to your phone should have their credentials changed, including username, if possible. If you're not already doing so, make sure you're running a software firewall on each of your machines.
  • Gmail: I'm assuming that you have a Gmail account and that several of your services are tied to this account. Consider using the Google Authenticator service that Google provides. It requires a 6 digit PIN whenever you try and use your Google account for ANYTHING that isn't already approved. Your email account generally is the apex for many other accounts. Set a password on it that is different from all other accounts (which you should always do anyways) and implement the maximum security your provider allows.
  • Additional Security Moving Forward: For credit cards and bank accounts, setup email/text notifications to notify you when charges are made or when new devices are used to access your accounts. Most banks offer this. Also, be very careful about the applications you install on your phone. It's possible the the infection came from an application that was installed by you to begin with.
  • Thanks, Jack. Great tips and I'm pleased that I've done router firmware upgrades, add 2FA on Gmail, and set up the alerts already. Scanning Drive and blocking ports are two that I have not done and will now add to my growing list. – user1883779 Mar 7 '16 at 17:33
1

RemoteAnyThing is actually a SMS management app designed to let you offload control over SMS to a computer (to read/send SMS without using your phone). It isn't itself a virus, but obviously it is very useful to an attacker going after one time use codes for banks, sent to phones via SMS. This would also let them (depending on if your provider does this via sms) set up call forwarding. Lastly, you (or an attacker, unfortunately) can deploy this via the Google Play store so the actual attack probably started as a compromise of your Google account, and led them to your phone which through clever app usage allowed them to steal two factor auth tokens.

I second the other answer, using 2FA on your Google account is a really REALLY good idea, it hardens the accounts that basically encapsulate your whole life (esp if you use an Android powered phone) and it is impossible to understate the need to take every precaution when protecting access.

Edit: to more completely answer your final question: RemoteAnyThing appears to operate via a direct connection to a computer, hence the port availability. So, either your desktop was compromised to run the software in secret, or your router was compromised to port forward the connection from the software running somewhere else (on the attackers' computer or a zombie intermediary).

  • Thanks, Jeff. Yes, I have reason to believe my Google account was compromised first, possibly via credentials from Adobe breach. No 2FA on it at that time. In addition, I apparently logged in to my bookkeeper's computer with my Google account and despite my historic vigilance in not saving that password and always logging out, I must have been lax one time. So, for a few months, my bookkeeper was storing passwords, not realizing that they were getting stored to my Chrome account. She was very surprised when I showed her what I knew about her passwords. Basically, I made every possible error. – user1883779 Mar 7 '16 at 17:31
  • Woah that's intense. FYI one handy trick when you share computers and have to disclose sensitive info, is to use the "privacy mode" in the browser. It might even help, in your work environment, to use this by default and to only use the nonprivate version when absolutely necessary. Privacy mode simply doesn't allow creds or cookies to be saved, meaning as long as you remember to close the browser, your secrets are safe. – Jeff Meden Mar 7 '16 at 21:14

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.