Spy/TheftAware!Android - Released Jul 20, 2010 - Last Updated Jul 26, 2010
Detection Availability
| ||||||||||||
Visible SymptomsDepending on situations, the victim's phone may experience:
| ||||||||||||
Detailed AnalysisThis application, named Theft Aware, aims at securing one's mobile phone against loss or stealing. To do so, for instance, it plays a loud alarm sound if the SIM card is replaced by an unauthorized one.Although it can be used as a legitimate tool, this application may also be used against the phone's owner by attackers in various scenarios. In particular, there are several potential dangerous scenarios if the application is installed on a victim's phone without his full consent (e.g phone left unlocked in a location where the attacker has physical access to it, or victim tricked by some social engineering to install it) . In such cases, the attack may geographically trace the victim, lock the phone remotely, retrieve all contacts or important SMS on his phone, or even have the victim's phone silently call the attack so he can listen to the surrounding conversations. The application is designed to be difficult to spot for the victim. On Android phones, it is listed under a configurable name in the Application List. This name is typically chosen so as not to alarm the victim (see Figure 1).  Figure 1. Choosing a non suspicious name for TheftAware. Technical DetailsThe setup package is typically found on the Android Market, and contains the following files:
 Figure 2. Installing the TheftAware agent on the Android phone Finally, the attacker can configure the application (see Figure 3) and erase the setup application from the phone.  Figure 3. Configuring TheftAware virus. | ||||||||||||
Recommended Action
|
Reference: ID - 1951776
