0

Following Scenario:

You unlock your phone and you give it to someone so they can promply check it out (since it's a new phone). Now let's presume that the very exact person has intentions to install spyware on you phone without your knowledge. Without you looking, can that person go to settings > allow downloads from unknown sources and type in their site where they have a link for spyware in the browser, start the download and install it on your phone.

  • Is this possible in 1 minute?
  • Are there any other barriers to doing this, other than the fact that you might catch them?
  • Can spyware be downloaded and installed in a short time frame?
7
  • 1 minute is enough if you have good internet connection.
    – defalt
    Oct 1 at 19:45
  • If it does get installed where will it hide? I read it can be an app but that would be easy to spot, you can find it easily if you go to settings and check applications right? If it doesn't stay hidden as an app how does it stay hidden? How can you spot it?
    – Shaki49
    Oct 1 at 21:49
  • w/ a custom otg cable and some other equipment you could prob do it in a few seconds. Oct 1 at 22:57
  • User-installed apps cannot be hidden. You can always go through applications to recognise the app you know you didn't install. It's slightly difficult to spot the spyware if it has ambiguous name which tricks most people to believe that the app must be used by system.
    – defalt
    Oct 2 at 8:30
  • So spyware only stays hidden as an application? It can't hide like a system file in settings or somewhere else, like part of the operating system?
    – Shaki49
    Oct 2 at 8:38
3

Is this possible in 1 minute?

It's not impossible:

  1. Open Camera and point to a QR-Code. 10 seconds

  2. Open browser and download the APK file. Depending on the file size, it can take 20 seconds or less.

  3. Open the APK, if you installed anything from the browser before, no confirmation is needed. Depends on the APK size too, but can be done in 5 to 10 seconds.

  4. If confirmation is needed, attacker can go to the settings tab straight from the install screen. More 5-10 seconds here.

So best case scenario it could be done in 40 seconds.

Are there any other barriers to doing this, other than the fact that you might catch them? Can spyware be downloaded and installed in a short time frame?

There are few barriers you can set, the main one if not allowing people to use your phone. Or install a custom ROM that disallows installation of APK files without putting the PIN or fingerprint.

And spyware can be downloaded and installed in a short timeframe. It only need to install a loader, and it can be very small. After installation, this loader can download more modules as needed.

6
  • Will the phone ask for the passcode before the download or install?
    – Shaki49
    Oct 1 at 18:17
  • Android won't ask anything if the phone is already unlocked.
    – ThoriumBR
    Oct 1 at 18:22
  • What is a loader? when you set u an account every time you download something from play store it asks for your password right? so its not the same with downloading from google?
    – Shaki49
    Oct 1 at 18:42
  • A loader is a small app that will download the other parts of it. Like the Firefox installer for Windows: it's a small executable (less than 10 MB) that will download the rest of the files.
    – ThoriumBR
    Oct 1 at 19:17
  • I read that you can check your phone to see if you have "symptoms", like battery drainage, mobile data depletion and one of them was to see if allow downloads from unknown sources was turned on. Why would that matter? Wouldn't the person turn off allow downloads from unknown sources after installing spyware to hide his tracks as if it was never tampered with? Or if you turn it off the spyware won't work? Does it matter whether it's on or off after spyware has been installed?
    – Shaki49
    Oct 1 at 21:42
0

Even quicker scenario: a USB rubber ducky or similar could be plugged into the device's USB port. The attacker does not need to interact with the screen at all if the phone is unlocked and the device is programmed correctly, as the device will simulate an auto-typing keyboard.

Alternatively, and similar to the QR code method, an NFC tag could be placed near the phone, causing it to open a download link with little effort.

The biggest device-specific hurdles would be enabling unknown application sources and granting permissions, due to differences in vendor UIs. There shouldn't be a need to authenticate at any point. Once installed, the app generally needs to be started once before it is allowed to start on its own; this could be part of the script. There would likely be no further steps to take within the app unless it's an off the shelf product of a certain sort.

Once installed, the unknown sources option could be disabled again.

3
  • If the person who downloaded and installed spyware ignored the warning from play protect and installed his spyware, will you detect it if you do a system scan on play protect after it has been installed and it starts running?
    – Shaki49
    Oct 2 at 8:41
  • @Shaki49 it depends if Play Protect is actually capable of identifying it as malicious. Oct 2 at 13:41
  • So will spyware always appear as an application or will it be something else? For example: some of those paid “parental control” spyware apps will stay hidden as a settings app. Can it be hidden in a different way, which doesn’t appear anywhere?
    – Shaki49
    Oct 2 at 14:12
0

Installing an APK from the browser is not the only way to install a spyware on your phone within 1 minute. If the person is determined to spy on you, it can be done.

The steps to allow install Apps from unknown sources described are related to Android versions 7.X or lower. Which means that your phone does not have the security updates since 2017. Since, some vulnerabilities, Remote Code Execution (RCE), was discovered.

In this case, enabling Bluetooth can be enough to get a remote access to your phone (BlueFrag: Bluetooth Zero-Click RCE).

2
  • 1
    So what you are saying is in 2021 if a hacker wants to install spyware on your phone by clicking a link from their website or sending an email link to you and opening it through your phone wont be possible because of the modern operating system of the phone? Other than this Bluetooth method which ways can they do it in that time frame?
    – Shaki49
    Oct 2 at 14:19
  • Nope, I am saying that if you give to an untrusted person your smartphone for 1 minute or less, even this person does not did anything with it, it will become a psychological problem rather than technical (nocebo effect). Imagination is the limit.
    – St0rm
    Oct 2 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.