I was thinking about spyware and wondered if you could sniff for suspcious network traffic from spyware.

Mobile spyware usually uploads messages, location and images, is it possible to analyse network traffic and detect these actions?

I can't seem to find many google resources mentioning this. I know that GlassWire does network monitoring on a per-device basis and alerts for suspicious network activity.

An issue is detecting real spyware image uploads and not legitimate user uploads.

  • 1
    There is no generic way to do this. If one knows for specific spyware one can maybe detect it based on properties like destination, behavior and maybe even content (although commonly encrypted). But there is nothing inherently malicious in such uploads, i.e. no magic marker which makes it easy to distinguish good from bad. With clearer expectation what to expect from good traffic one might detect traffic which does not match these expectations. But often these are false positives and it is also often possible to match malicious traffic match expectations about good traffic. Oct 30 '21 at 6:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.