How could a phone number be used as a means to gain access to a smartphone? I am reading claims that you could receive a call or SMS on your phone and an attacker can install their malware that way. Are methods like that possible? That seems a bit over the top to believe. What exactly are the methods used to install malware on a smartphone. I have a pretty elementary understanding of information security, any books or sites to read are appreciated.
-
You don't "install an exploit", an "exploit" is something that takes advantage of a "vulnerability" to cause some unintended effect (such as installing malware).– AndrolGenhaldSep 23, 2019 at 20:10
-
Where can we find that claims?– tungstenSep 23, 2019 at 20:13
-
There was one vuln i remember where you could craft an mms that lead to code execution but its pretty old.– yeah_wellSep 23, 2019 at 20:26
Add a comment
|
2 Answers
I think you are talking about Stagefright(CVE-2015-3864, /exploits/39640). It resides in Stagefright, an Android code library that processes several widely used media formats. It affects all Android phones upto version 5.1. It was first reported by a researcher of the company Zimperium. The vulnerabilities are extremely dangerous and extremely rare. It allows the attacker to compromise the victims phone without the user even taking any action, no authentication is required, you just have to know your vitctim's phone number, Android showing you a preview on your unlock-screen is enough to trigger the exploit and thus allowing to execute arbitrary code while you sleep and the day after the SMS is deleted and your phone is still compromised without your knowing, The attacker does this by sending a crafted massage that contains the arbitrary code mostly in the form of a MP4-video, the crafted SMS is in the MMS format which was found to be very useful in this process of exploitation.
Not sure what's hard to believe, bad code is written all the time. What you're talking about is a fully remote attack, which means an attack that a perpetrator can start without access to the victim and without the user doing anything.
You wanted links, and Project Zero always offer good posts on this kind of thing, and they've shown both iOS and Android demonstrate the attack surfaces in a phone that could be attacked by a vector simply by knowing a mobile number. There's also StageFright which was suggested by Tungsten.
The methods obviously vary depending on the vulnerability and issue at hand, so that part of your question is way too broad, but the above should hopefully be enlightening reading.
-
Ok perfect thank you this is great info to start digging into.between you and tungsten thanks again– Gh88Sep 24, 2019 at 1:52