Android malware builds 3D model of user's environment
Connecting state and local government leaders
A team from Indiana University frames PlaceRaider as a potential tool for burglars, but what if it got into government buildings?
If government agencies needed another reason to be wary of allowing cameras into sensitive areas, a research team at Indiana University has a good one.
The team, led by Robert Templeman, who also works at the Naval Surface Warfare Center in Crane, Ind., has created a malware app, called PlaceRaider, for Android phones that will surreptitiously record a room through the phone’s camera and then build a 3D model, allowing an attacker to virtually forage through it, looking for documents, calendar details and other information.
Related stories:
BYOD security: Are agencies doomed to a permanent game of catch-up?
Android malware growing at 'staggering' pace, report states
Although the researchers frame PlaceRaider as a likely tool for thieves to get a look inside people’s homes, it’s easy to see how it could be used for espionage and other nefarious purposes.
In a paper posted on arXiv, the researchers note that what they call “sensor malware” to date has mostly focused on tactics such as recording spoken credit card numbers or detecting keystrokes. They decided to try building “visual malware” and came up with PlaceRaider.
They made the app to work on phones running Android 2.3 and higher out of convenience, they wrote, but assume that such malware could also be developed for other platforms, such as iOS and Windows.
PlaceRaider could be embedded inside one of the advanced camera apps on the market, which would give it the permissions to take photos and record sensor data, the researchers write.
Once in place, it mutes the phone’s camera shutter and begins taking 1 megapixel photos, noting the time of each photo and the orientation of the camera. The PlaceRaider app sorts and formats the images -- discarding duplicate, blurry or dark photos, for example -- and then sends the data to a server, where an attacker uses an algorithm that the team developed in order to sort through the images and sensor data, and construct a 3D model.
The team conducted a test with 20 users who were told they were part of a study on smart-phone usage. Participants were asked to perform routine smart-phone functions --making calls, browsing the Web, using basic apps -- in a test room in which financial data, bar codes and other information was planted.
The researchers were able to get 3D models out of all 20 data sets and find the data they had planted. And although simply sifting through the raw images could also yield valuable information, the research team said the 3D models made finding that information a lot easier.
PlaceRaider would seem to open up a new front in malware for mobile devices, which are increasingly becoming a part of public-sector employees’ work lives. Government agencies keep cameras out of sensitive areas and prohibit their use in other areas, but a camera that’s recording images and sensor data without the user’s knowledge could pose a problem, especially as “bring your own device” programs expand.
What could you do to prevent “visual malware” from operating? The researchers make a few suggestions, including starting with the standard advice of being careful about downloading apps, making sure they come from a trusted source.
They also suggest that manufacturers take stronger steps to require phones to make a shutter sound when taking a picture, perhaps with hardware that couldn’t be altered by software. Android phones require a shutter sound now, but the team was able to get around that by muting the speaker. Operating systems also could require internal permissions to access a phone’s accelerometer or gyroscope, they wrote, which Android and iOS currently don’t do.
And phones could have the same type of image-filtering software that PlaceRaider has, assessing the quality of photos as they’re taken. If a camera is taking a lot of dark photos from inside a pocket, for instance, the OS could ask the user if he wanted the photos -- in which case, the jig would be up for an attacker.
Whether this type of malware becomes a major threat remains to be seen. With the research team’s report, the cat is at least partly out of the bag. But it’s another indication of how the popularity of mobile devices can attract malware of all kinds. And it gives mobile-leaning agencies one more thing to guard against.
NEXT STORY: Using a ‘sinkhole’ to squash the Nitol botnet