9

I recently found a site, Cell-Spy-Stealth.com, that claims to sell spyware which can be targeted on a phone by simply making a call to it: "It will work even if you get the voice mail, or if the target phone is password protected." It claims that after this one-time call, your phone will have access to all live SMS, calls, photos, videos, data, GPS (if enabled) and even the microphone while unused. It further claims that it is 100% undetectable and untraceable.

Is this really possible? If so, would there be any way to neutralize such a breach?

10

Any site that claims to be able to do that is a scam. Such technology would have to exploit some kind of backdoor, and if such a backdoor exists, it would only be known to law enforcement. If knowledge of such a backdoor leaks, you can be sure that there would be a media frenzy over it, and the vulnerability would quickly be fixed.

Phone monitoring software exists, but all of the legitimate ones require either physical access to the phone to install, or finding a way to deceive the owner into installing it.

  • This makes a lot of sense, the website was very shoddy, and more reputable websites I found in checking this out were selling more believable wares. But I couldn't find anything that addressed it authoritatively till you posted. – Daniel Nov 8 '14 at 23:34
  • 3
    I don't have a ready example, but I do recall reported vulnerabilities where a specifically crafted (phone model specific) SMS or MMS would enable remote root-level access for certain 'feature-phones'. – Peteris Nov 9 '14 at 5:09
3

There certainly are zero-day exploits out there for Android and iOS. So the technology exists for this to be real. In fact there is a thriving black market where discoverers of these exploits can sell them to the highest bidder -- here is an interesting article on that topic.

That said, according to the above article, Android exploits sell for $30,000 - $60,000 and iOS exploits for $100,000 - $250,000. Nobody is going to spend that kind of money on the black market and then turn around and open a junk website where people can see if their "Daughter is still seeing that no good jerk" for $27.

Also consider that once someone starts waving a vulnerability around the internet like that, it's usually a matter of days until Google or Apple figure out what's going on and patch it. Vulnerabilities only stay vulnerabilities if you keep them secret (unless people are using a version of Android so old that it's not getting updates anymore, in which case they're on their own).

More likely, this is a scam where you pay them $27 for the privilege of getting your own phone infected. The main tip-off is that they want you to download and run their software -- and not even through the app store.

2

There is known vulnerability called: Stagefright, but it works by sending you a MMS message. It only works in Android and new models have been patched.

I agree, it smells to a scam. Perhaps they know some vulnerability, but that could only work either in iOS or Android, but I don't think in both. Also it will depend on the model (OS version and hardware). As tlng05 said, if such vulnerability exists, it would have hit the news. Perhaps it is not confirmed yet? I agree with Mike Ounsworth that its more possible they want your phone infected and they will be able to control your phone / hijack it by installing their app.

  • Good thought on StageFright. Though the site says "iPhone, Windows Mobile, symbianOS, BlackBerry, Android, Linux (?), palm web, with pics of phones from iPhone to a '98 brick phone, so some BS is happening somewhere lol. – Mike Ounsworth Aug 19 '15 at 3:03
  • @MikeOunsworth: lol.. I agree. – lepe Aug 19 '15 at 3:29
  • 3
    Also, this post was from November, long before stage fright went public. – Mike Ounsworth Aug 19 '15 at 3:33
  • Mike: You are right. Sorry for joining late. As the vulnerability existed since 2010, chances are that someone could have discovered it long before (however, I don't think it applies to the case discussed here). – lepe Aug 19 '15 at 6:28

protected by Community Sep 25 '16 at 9:02

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.