Malicious Mobile Tracking Made Easy

Black Hat Sao Paulo speaker discusses Snoopy, a distributed mobile tracking network that can profile users online and in the real world

Exploits and hacking tools in the mobile space will get ample airtime at next months first Black Hat Regional Summit in Brazil. Among the presenters: a researcher who developed an affordable, distributed mobile tracking network that could take advantage of weaknesses in the way mobile devices probe for Wi-Fi signals to keep tabs on users physical and digital movements and intercept data from their devices.
Unlike other similar systems of the past, this one didnt depend on bulky laptops or large antennae, says the speaker, Daniel Cuthbert, COO of SensePost.
We thought, could we build a framework that moved to more of a distributed, smaller sneaky surveillance-style approach? he says. We did it by making a couple of prototypes -- our first was a Nokia N900 phone.
The first prototype gave Cuthbert all of the capabilities he needed to run the surveillance project he calls Snoopy: It was a Linux-based device with an IEEE 802.11 adapter supporting packet injection and general Internet connectivity. And it was small enough to be spread around public places without attracting attention. The idea was to create a dumb drone out of the device so that it would take data collected from victim devices and push it to a central server using a VPN.
[Your organizations been breached. Now what? See
Establishing The New Normal After A Breach
.]
So even if we lost a drone or it got stolen, it didnt matter -- without the data on the drone it was useless, Cuthbert says.
Using a very old vulnerability found back in 2005 that enables an attacker to look at probe requests made by devices looking for Wi-Fi networks it had previously connected to, the drones could find probe signals constantly sent out by devices and start to collect MAC addresses and other information that would make it possible to develop profiles about the user who owns such devices. For example, by placing a number of drones in popular London Underground stations, Cuthbert was able to collect enough information to start physically tracking the whereabouts of users as they passed through the stations -- tracking when they went to work and came home, and even where they lived.
We listened out for all the probe requests, connected to them, and then used a Wi-Fi war-driving service like Wigle to see if we could do a profile on that user. If you did it over a period of two or three days, you could figure out where their home was, where their work was, and where some of the common places theyd go with their phone, he says. The drones assume Wi-Fi was turned on, the phone was connected to Wi-Fi at home, and that the home address had been mapped by a Wigle volunteer, he added.
Taking things a step further, the drones could also be set up to impersonate a Wi-Fi access point already predefined in victims phones, so that when the probe request is made, a connection is automatically made to the malicious drone. This was done at Black Hat Las Vegas, a place where the majority of the crowd ostensibly should know better than to walk around with Wi-Fi turned on. And yet Cuthbert was able to use it effectively; once the devices were connected, it was possible for the drones to collect information about push notifications, email, social media, and more.
Whether it was physical or Internet traffic data, the Snoopy project was able to dive into it using Maltego to examine patterns for detailed analysis about the users behavior and habits online and in the real world.
According to Cuthbert, while many other projects have performed similar tasks in the past, Snoopys comprehensive approach should raise eyebrows about how much we trust a device that could become such an effective surveillance tool for those around us.
I think the key thing that we got out of this was how trusting people were of their devices, he says. Theres a hell of a lot on your phone at the moment, and generally speaking youre logged into a whole lot of services.
He also says that a project such as Snoopy can make it possible to effectively commit mass attacks against phones and easily develop, for example, a mobile botnet quite easily.
Imagine you wanted to build a botnet of mobile phones -- we would go to a large area, wed set up a fake AP that listened out for common APs that people connected to, and the nice thing is if you then wanted to drop malicious ads into all the HTML streams, or if you just wanted to run Metasploit, you can do that because everything is controlled from a central server, he says. So, whereas before [when] you wanted to attack a phone you had to do a man-in-the-middle on that phone, and it is a very manual process, here its very easy to attack a lot of phones at once.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security	▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Malicious Mobile Tracking Made Easy