Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android Backdoor GhostCtrl Can Silently Record Your Audio, Video, and More

blog.trendmicro.com

Post reply on HN
Print view View original

31–40 of 66 posts

Re: Android Backdoor GhostCtrl Can Silently Record Your Audio, Video, and More

#31

Post by fulafel »

debatem1 wrote: post #15

Why is this being called a backdoor? Is there any indication that that's what it is? Except for the headline, the only claim even remotely as serious made in the article is that it can root some devices, and figuring out which ones is left as an exercise for the reader...

C&C servers, evasion techniques like masquerading as system package, bootstrapping the encrypted payload malware with a wrapper APK, ransomware features, piles of exfiltrated informaiton, intercepting calls and text messages, ransomware functionality... it's like a crook with a record the size of a phonebook.

Re: Android Backdoor GhostCtrl Can Silently Record Your Audio, Video, and More

#32

Post by la_oveja »

aidos wrote: post #19
kbart wrote: post #8

Earlier quoted context omitted.

It was (still is?) a common practice to grant all permissions when installing an app from Google Play. Most people don't even look at the "annoying" popup that lists permissions to be granted and just press "accept" without ever reading it.

I mostly have apple devices but have a Nexus 7 at home. I'm not sure which version it's running. Every time I install something I have a sinking feeling as it asks me to allow it to do things that sound wildly beyond anything I would ever want an app to do. Things like an app for my kids that asks for something along the lines of "access to the files". Hopefully things have improved with the newer OS but man I feel u…

I see this very interesting:

Android prompts info about whats happening, iOS just ignores them and keeps going.

With this simple difference, people tend to think iOS works better! I cannot trust an OS that doesn't ask me stuff, or takes things for granted.

Best example is the "Force close" dialog on Android vs just crashing the app on iOS.

Re: Android Backdoor GhostCtrl Can Silently Record Your Audio, Video, and More

#33

Post by monkaS___ »

la_oveja wrote: post #32
aidos wrote: post #19

Earlier quoted context omitted.

I mostly have apple devices but have a Nexus 7 at home. I'm not sure which version it's running. Every time I install something I have a sinking feeling as it asks me to allow it to do things that sound wildly beyond anything I would ever want an app to do. Things like an app for my kids that asks for something along the lines of "access to the files". Hopefully things have improved with the newer OS but man I feel u…

I see this very interesting: Android prompts info about whats happening, iOS just ignores them and keeps going. With this simple difference, people tend to think iOS works better! I cannot trust an OS that doesn't ask me stuff, or takes things for granted. Best example is the "Force close" dialog on Android vs just crashing the app on iOS.

The requirement to prompt for individual permissions in iOS significantly predates android's implementation of the same. Besides, am I mistaken or is the 'Force close' dialog ('xyz keeps crashing') only offered _after_ android first quietly attempts to restart the activity as if nothing went wrong?

Re: Android Backdoor GhostCtrl Can Silently Record Your Audio, Video, and More

#34

Post by kbart »

StavrosK wrote: post #26
ClassyJacket wrote: post #18

Earlier quoted context omitted.

Well it's not like there's any option to deny them. You can only not install the app, unless the app chooses to build for the Android 6 permission system.

Of course you can deny them. After you install the app, just go into settings and deny every permission.

Does not always work because shady apps often check for permissions on boot and refuse to start if i.e. some fart app can't access that contact list of yours "it desperately needs to function properly". Denying permissions only mitigates cases when all permissions are asked due to the lack of proficiency or laziness of app developers not an intended malicious behavior.

Re: Android Backdoor GhostCtrl Can Silently Record Your Audio, Video, and More

#35

Post by TACIXAT »

breakingcups wrote: post #7

What's so special about this one compared to the other well-known trojans (like omnirat, the RAT this one is based on)?

It literally is Omnirat. From the article:

>GhostCtrl is also actually a variant (or at least based on) of the commercially sold, multiplatform OmniRAT that made headlines in November 2015.

Re: Android Backdoor GhostCtrl Can Silently Record Your Audio, Video, and More

#37

Post by Joeri »

tym0 wrote: post #25

Title is misleading, it makes it sound like the backdoor is in the Android software while this is just malware.

The point is that android makes it possible. You don't have these things on iOS because apple doesn't allow them, where google does.

Re: Android Backdoor GhostCtrl Can Silently Record Your Audio, Video, and More

#39

Post by Ajedi32 »

Joeri wrote: post #37
tym0 wrote: post #25

Title is misleading, it makes it sound like the backdoor is in the Android software while this is just malware.

The point is that android makes it possible. You don't have these things on iOS because apple doesn't allow them, where google does.

Any platform which allows users to install arbitrary software of their own choosing "allows" this. GNU/Linux for example, also allows this. As do Mac, Windows, and jailbroken iOS.

Re: Android Backdoor GhostCtrl Can Silently Record Your Audio, Video, and More

#40

Post by captainlego »

fulafel wrote: post #31
debatem1 wrote: post #15

Why is this being called a backdoor? Is there any indication that that's what it is? Except for the headline, the only claim even remotely as serious made in the article is that it can root some devices, and figuring out which ones is left as an exercise for the reader...

C&C servers, evasion techniques like masquerading as system package, bootstrapping the encrypted payload malware with a wrapper APK, ransomware features, piles of exfiltrated informaiton, intercepting calls and text messages, ransomware functionality... it's like a crook with a record the size of a phonebook.

But, unless I somehow missed a big point, doesn't it start with the user installing a malicious package?
Post reply on HN