Stealthy Video Capturer: Videobased Spyware in 3G Smartphones
Stefan Maurer
Liz Ellis
Why secure Smartphones?
• Increasing public usage
– More people buying and using Smartphones
– (insert statistic here)
• Smartphones are incredibly mobile
– Access to the most private moments
– Intimate details about habits/lifestyle revealed
Introduction to SVC
• Allows hackers to have control of camera
• Records and sends video to a third party over
an internet connection through the phone
• Three phases:
– Install SVC without device owner’s knowledge
– Collect video
– Send files to hacker
Infection
• Trojan horse attached to tic-tac-toe game
• Binary executable file of SVC attached as
resource file of game
• After compilation, creates executable codes of
SVC
• When game is executed, SVC attaches itself
independently and continues running even
after game is closed.
Application Layer
• 3 modules
• Video capture
– Takes chare of camera
• File sending
– Sends data to hacker
• Triggering algorithm
– Dynamic control module
– Determines the right time to run other modules
“Stealthiness” and acquiring info
• Which is more important for the SVC intender
• “Stealthiness” – term used by team
– Device owner should not know program is running
– Team focuses on this
– 3 aspects: power, CPU usage, and memory
• Information acquisition
– Sometimes, more important to get all info than
not get caught (crime scene/contracts signed)
• Scenario decides triggering algorithm!
Triggering Algorithm
•
•
•
•
2 parts: capture and sending
Should change based on practical application!
Main challenge: when to capture/send?
CeSetUserNotificationEx()
– Allows spyware to record even when phone is idle
• Uses Windows Mobile API to gather more info
– Power, CPU status, phone dialing, etc.
– Device owner should have little suspicion
SVC Architecture
When to Capture/Send?
• Both use specifications from API
• Examples:
– Power level between 20%-80%
– CPU usage should be no more than 50%
– Device owner talking on phone: capture
– Connection to internet (WiFi/Bluetooth): sending
• If there is knowledge about victim, can use
living habits to determine when to record
– Ex: businessman having important weekly
conference
Video Capture Module
• Called by triggering algorithm
• Phases:
– Open camera and take video
– Determine whether images are static or dynamic
– If dynamic images, compress and store
• If images are static, process terminates
– Pictures of inside of pocket are not useful
• Files are hidden on the disk in hidden and
unused folders
Video Capture Flow
How to Access Camera
• Native API has little customizability
– Can access camera, but no flexibility (frame rate,
file format, etc.)
• Access and build filter manually with software
• Several COM controllers developed
– Enable modifications of encoding and file formats
– Video Encoder and Custom Format File Render
Data Compression
• Data compression: large files are easy to
detect and hard to send
• H.263 is used to compress files
– Many Smartphones use hardware for
compression, which is inaccessible
– Software compression is used instead
– Lower compression rate but less CPU cycles than
H.264
File Sending
• Need a wireless connection
– WiFi / Internet
– Bluetooth
– 3G Network
• Some delay between capture and sending is
acceptable (real-time not mandatory)
• Use transmissions that are free of charge (unlike
MMS)
• Several methods considered: MMS, FTP,
streaming
File Sending cont.
• Prefer ability to use any wireless connections
• Video files are generally large
– Segment into portions, and send individually
• Email is ideal
– easily customizable, free, uniformly supported,
flexible in syntax/size
Results
• O2 XDA Flame chosen for testing
– Windows Mobile 5.0 OS
• Evaluation of stealthiness
– CPU, memory, and power consumption
• Four states
– J1: SVC running with backlight off
– J2: Camera operational, but recording
– J3: Recording Video and compression
– J4: Sending File to the intended viewer
Power/CPU Consumption
Results cont.
• Memory usage is almost constant
– SVC uses less than WMP (relevance?)
• J3 uses a large amount of power and CPU
• Due primarily to the complexities of the
compressions algorithm
• Performance of SVC can be greatly improved using a
better compression algorithm
Author's Opinions
• Making SVC smarter
– More intelligent triggering algorithm
• Monitor user's living patterns
– Exploit image recognition to capture video
• Resistant to Anti-Virus
– AV is useless against new viruses/spyware
• Security of Phones
– Low default security settings on smartphones
– Biggest Vulnerability: People are stupid
Our Opinions
• Windows Media Player?
• What if the user does not use WiFi/Bluetooth
frequently?
• CPU consumption of J3
• When does J4 send the files?
– Large CPU consumption
Work Cited
• Xu, N., Zhang, F., Luo, Y., Jia, W., Xuan, D., and Teng, J. 2009.
Stealthy video capturer: a new video-based spyware in 3G
smartphones. In Proceedings of the Second ACM Conference
on Wireless Network Security (Zurich, Switzerland, March 1619, 2009). WiSec '09. ACM, New York, NY, 69- ‐78.