4

An acquaintance of mine recently came to me with strong suspicions that their non-rooted 6.0 Android device had been infected by a third party who has regular physical access to it. While I have a background in information security, conducting pentests and whatnot, I don't know much about Android forensics. Most of the documentation I've found online is dedicated to contacts / text messages recovery, which does not really fit this particular scenario.

Putting the device under Wireshark and looking at the traffic hasn't yielded anything, but stock ROMs are packed with so many apps that there's a lot of background noise.

Is there a particular methodology I could follow to figure out whether a trojan has been installed on the phone? I'd accept references to books as well.

Thanks in advance!

  • You should start by checking a task manager, and possibly killing irrelevant processes to simplify your troubleshooting. Knowing why they suspect the device is infected could help a bit. – Julie Pelletier Sep 7 '16 at 0:50
  • @JuliePelletier Thanks for the input. The suspicions stem from someone showing knowledge of information coming from phone communications. That someone also has the technical know-how and probably moral vacuity required to infect a device. – executifs Sep 8 '16 at 0:23
2

I've had some years of experience with hacking round in mobile environments, here's some of the methods and notes that may help you in getting up-to speed and keeping your own hardware a bit safer while performing your investigation.

For general threat modal and network sniffing ya may wish to check my answer posted to the question of detecting if a phone is secretly sending data noise will have to be sifted though though if the target device isn't compatible with non-root firewall options suggested there and be sure to pay attention to referenced malware jumping from Android to USB connected PC before attempting USB connected forensics. Another option I don't think I listed there was that DNS look-up monitoring/poisoning may help in sorting legit apps' traffic from non-legit traffic.

Small warning, while I've not seen it in the wild it's very possible that the infected device could attempt to attack the Wi-Fi networks it comes across, so consider making a VAP (Virtual Access Point) to separate the network of the infected device from anything else while performing MiTM investigations. Metasploit and others aren't too difficult to install on Android so be very cautious of that infected device sneezing on others.

Now because you've stated that network traffic is noisy and you'll likely end up plugging it in to a USB for imaging it would behoove you to consider either USBguard or disabling HID entirely and use ssh to interact with your forensic device. However, because malware keeps getting smarter it would be a good idea to only use a cheaply replaceable device for USB based forensics; hint web search "system on a chip" and narrow the available options to boards with x86 CPU architecture to have an easier time loading ADB (Android Debug Bridge) drivers and maintaining a solid connection for imaging the file system.

Note once you've sufficiently secured the device that'll be connecting to the possibly infected device the best thing to keep in mind is that push & pull commands with ADB are just as forgiving as in-file and out-file command line options used with dd, which is to say not very forgiving, so be careful.

Side note, Tripwire and similar file system tools can be very helpful for finding cross platform malware, but that and others would need setup prior to plugging in the infected device... only really applicable if your threat modal is sufficient to require forensic inspection of the device preforming forensics operations on the possibly infected device, and this also stats the line of questioning if the watcher is watching the watcher watching the watched in a trustworthy way... and if we go down that line of thought I'll hit the character limits for posting answers again.

Next up is emulating the imaged device, there's a few options but the AVD (Android Virtual Device) manager that comes with Androids' SDK (Software Development Kit) should be sufficient for this task. Make a backup of the possibly infected device, load a AVD to simulate the target's hardware and restore the backup to the emulated device's file system, then go to town on dissecting memory or setting breakpoints or even attempt to penetrate the emulated device in order to find egress points used by the original malware... it maybe possible to root the emulated device too to test if possible malware has been waiting for that before taking actions... oh and be sure to unplug/unmount and remove power from the physical device that maybe infected once you've loaded it's backup into the emulated environment. So long as you're working on an emulated version of the infected device your actions won't break anything for the client so get as rough with the emulated device as you like, however, if you've the space make a backup of the backup so that bricking the emulated device doesn't require re-plugging in the possibly infected device.

  • 1
    Most welcome you are and I'm glad it's satisfactory. Depending on what device your investigating you may also want to look into RIL (radio interface layer) and SD card firmware exploits too; some of the really persistent kinda of malware can embed themselves into parts of the hardware that can't be removed or reflashed easily... best of luck with your forensics if that's how the device was popped. – S0AndS0 Jan 6 '17 at 14:21
0

You can download Netstat Plus or PacketCapture to get a realtime view of all packets being sent out from the phone and you do filtering to narrow it down and remove all the "noise".

As other have suggested, Force Stop any known-good apps during the troubleshooting.

  • Thanks! Identifying known good apps is troublesome because I expect the malicious program to be handcrafted to some extent and possibly made to look like a legitimate android package. – executifs Sep 8 '16 at 0:24
  • 1
    yea but the IPs it reaches out to won't be [legitimate]. :) – HashHazard Sep 8 '16 at 0:50
  • 1
    It can be a VPS or rooted machine. If the phone is rooted, it can silently SMS out, ask the mobile service provider for SMS logs. – user400344 Dec 6 '16 at 9:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.