0

Can a “bad guy” spy on an android phone without installing spy apps (those apps that require payment)? By “spying”, I mean using key logger, screenshots, read messages and so on.

Is it possible to spy on an android without using such spy apps? Is there another way someone can spy on you?

Does “unknown sources” have to be turned on for spyware to be installed?

Can someone install some type of spying software or are spying apps the only way?

Let's say the “bad guy” has physical access to your Android device, how much time would that person need in order to install some type of spyware?

Basically, how do people install and spy on android phones?

I am worried that this might have happened to me, so if someone can explain this to me, I will be very thankful! Also, if my questions sound silly please keep in mind that I am not educated enough about this topic that’s why I am here.

7
  • Can an adversary exploit device “X” with some unknown way: Yes. Is this likely. Not that likely. Why would anyone invest the time and resources to target just you. If it’s about targeting larger groups, than you could be in the mix. But if as the old adage goes “all bets are off once someone gets physical access”
    – LvB
    May 31, 2021 at 19:29
  • 1
    "... those apps that require payment ..." - payment or not is irrelevant for the functionality of a software. And bugs like these even allow an attacker to take over a phone without having physical access, being nearby is sufficient. And taking over the phone also means the possibility of spying. But, just because something is possible in general it does not mean that it is easy nor that you are a target of this. May 31, 2021 at 20:06
  • @SteffenUllrich I would interpret the question to mean the legitimate apps for monitoring a phone: MDM, endpoint agents, employee monitoring apps, etc. These can be pushed to the phone by legitimate means (like the employer).
    – schroeder
    Jun 1, 2021 at 6:59
  • @Steffen Ullrich hey guys so basically what I mean is, are spying apps the only way someone can spy on your phone or are there other ways to do it? If there are other ways, what are these “other ways” and how likely are they to be used? Basically if someone wanted to install spyware on your android phone without the use of spyware apps, what does that person need to do? Do they have to create their own spyware software and then install it on your phone? How would they send it to your device? Through email or a simple google search that takes you to a malicious website?
    – user256642
    Jun 1, 2021 at 9:11
  • 1
    @Elate55 no. There is are a myriad of ways of doing that. And no way to exhaustieve list them here. And extricating data from a device is a completely separate question. (With a myriad of answers too)
    – LvB
    Jun 1, 2021 at 9:18

2 Answers 2

1

I assume that by saying "spy apps" you are talking about a specific type of paid apps. Well even those non-paid apps or even self-developed ones can spy on your phone due to the fact that your phone is generally not protected by Anti-virus solutions, so any amateur can create a remote access trojan (RAT) and spy on you.

Now, how can someone install this rat on your phone?

Physically: in 2 minutes he can disable Google Play Protect, and download and install his rat

Remotely: via social engineering techniques (such as spear phishing) or via an advanced technique called Zero-click attack

4
  • so lets say the “bad guy” has physical access, he would have to visit his own malicious website and download the rat through there? Also does download for unknown sources have to be enabled for this to work? Which way is easier to install? Commercial spying apps or creating your own spyware?
    – user256642
    Jun 1, 2021 at 9:25
  • @Elate55 yeah, the "bad guy" can download any apk file from a website under has control, there is no restriction in downloading files, The only restriction that he will face is after opening the APK file an alert message will popup saying "is not secure to install app for untrusted sources or something like this" . But this protection can be bypassed easily too. For the second question of course using commercial well developed apps is better than using self made apps. (They are usually better in performance, more features, less bugs, etc ..) Jun 1, 2021 at 11:27
  • 1
    @Elate55 there is no difference in ease between installing an approved app from the Play Store or a custom, downloaded APK, except for the warnings.
    – schroeder
    Jun 1, 2021 at 12:03
  • 1
    Physically, he can't disable Play Protect if the device has screen lock code.
    – defalt
    Jun 1, 2021 at 15:40
1

There can be endless ways to spy on android devices or phones in general. Device intrusion is one way to get in and it may not be always effective because of hardened OS protections and malware detection. Spying in general depends upon possible attack vectors that can be used to discover your secrets. E.g. Your wifi traffic, internet activity, online accounts activity and calling can be used to fingerprint your behaviour about how you use your device. If they are state actors, anything outside of scope of your device can be monitored.

If it's something that only exist on your device like your chat history of e2ee messaging, offline contacts, password manager, media, etc., device intrusion can exfliltrate this data if the level of compromise is deep enough. It's not as straightforward as installing a spyware app because apps themselves don't have enough permissions to monitor everything on your device and installing a spyware app without the authorisation of the device owner is not possible without exploitating vulnerabilities in your device. "Unknown Sources" option requires device to be unlocked to authorise installation and the source of the installing app should be also authorised to prompt installation if the source is not a system app.

What type of vulnerabilities can be used to silently install spyware is outside of scope of this answer. The specific is chain of any high serverity vulnerabilities that can give enough privilege to the attacker to install and grant permissions to the spyware or inject malware into installed apps who already have permissions. Fileless malwares have been seen in the wild to compromise both android & iOS. E.g. NSO Group is known to compromise journalists' devices just by ringing through WhatsApp calling. Jeff Bezos received a WhatsApp message laden with code that secretly snatched reams of personal data from his iPhone X. Once the mole is in, it can also be used to try out new exploits through that window.

Permission to log keys, access media elements and read contents on your screen depend on type of compromise. E.g. If the spyware app has gained accessibility permission, it can record touch input and read anything on your screen. Also, it's not necessary that vulnerabilities will always work. SELinux blocks processes that violate SELinux policy. State agencies can even force OEMs to deliver compromised OS update that can grant root access to them.

But let's assume this is not the case and your device is fully updated and the attacker doesn't have zero days to compromise your device "remotely". With physical access on the device, bootloader is locked and the screen is locked, there's nothing much an attacker can do except for receiving calls and reading notifications. Though notifications can be helpful to take over accounts that uses SMS based 2FA. It won't work if the device owner has disabled notifications for locked screen or if the device has been rebooted but not unlocked.

There have been some ways discovered by spyware agencies to decrypt data on a locked device. If the device has been unlocked atleast once since last reboot, also known as After First Unlock (AFU) state, data encryption keys are made available to the kernel in memory. Using exploits that can work at locked screen, they are able to compromise kernel, steal the key and decrypt the data. It fails if the device has not been unlocked since last reboot, also know as Before First Unlock (BFU) state. This design flaw is being addressed by integrating Inline Crypto Engine in modern SoCs to store keys and with introduction of Rust to reduce these memory based attacks.