Android Trojan records phone calls

A new Android Trojan is capable of recording phone conversations, according to a CA security researcher.

While a previous Trojan found by CA logged the details of incoming and outgoing phone calls and the call duration, the malware identified this week records the actual phone conversations in AMR format and stores the recordings on the device's SD card.

The malware also "drops a 'configuration' file that contains key information about the remote server and the parameters," CA security researcher Dinesh Venkatesan writes in a blog, perhaps suggesting that the recorded calls can be uploaded to a server maintained by an attacker.

TARGET: Malware writers gunning for Google Android

Venkatesan tested the Trojan in "a controlled environment with two mobile emulators running along with simulated Internet services," and posted screenshots with the results. It appears the Trojan can only be installed if the Android device owner clicks the "install" button on a message that looks strikingly similar to the installation screens of legitimate applications.

After the malware and the remote server configuration file are installed on the Android device, making a phone call "triggers the payload" -- in other words, recording the call and storing it on the SD card.

"As it is already widely acknowledged that this year is the year of mobile malware, we advice the smartphone users to be more logical and exercise the basic security principles while surfing and installing any applications," Venkatesan writes.

While Android provides more flexibility than the iPhone by allowing installation of third-party applications, even those that were not approved for the Android Market, this freedom seems to come with increased security risk. Malware-infected applications have also been found in the Android Market itself, but users can protect themselves by installing antivirus software, just as they would on a PC.

Follow Jon Brodkin on Twitter: www.twitter.com/jbrodkin

Read more about wide area network in Network World's Wide Area Network section.

Register now for the ARN Security Forum 2013 on June 4 at the Sydney Mint

• Bookmark this page
• Share this article
  •  
  • facebook
  • slashdot
  • digg
  • Reddit
  • stumbleupon
  • linkedin
  • twitter
• Got more on this story? Email ARN
• Follow ARN on twitter

• Share
  Share this article1

  •  google+
  • facebookfacebook
  • slashdotslashdot
  • diggdigg
  • RedditReddit
  • stumbleuponstumbleupon
  • linkedinlinkedin
  • twittertwitter
• print
• email
• Bookmark