Security Alert: Be Cautious with Android Spyware -- GamblerSMS

By Xuxian Jiang, Associate Professor, Department of Computer Science, NC State University

Recently my research team came across an interesting Android spyware -- GamblerSMS. This Android app is designed to be a spyware and may be intended to be used to monitor kids/children or cheating spouce. (The name of this spyware is shown as "SMS Spy".) In its design, the spyware will monitor every single SMS message received/sent from the phone and record every outgoing phone call. If installed, the spyware will first allow the user to configure (another) phone number to receive the SMS messages sent from the monitored phone and an email address to collect recorded audios of phone calls made from the monitored phone. However, one interesting thing about this spyware is that the author of GamblerSMS will also automatically keep a copy of ALL the recorded phone calls, which is probably unbeknownst to the spyware users.

How it works:

The spyware can be installed on a phone without exihibiting an icon on the home screen. When being installed, it will ask the user to provide a phone number to receiver incoming/outgoing SMS messages and an email address to receive recorded phone calls. After that, it will run in the background silently. Note that the spyware will also automatically boostrap itself with a background service SMSMonitor every time the phone reboots.



Our initial analysis shows that when the monitored user receives a SMS message, GamblerSMS will forward the received SMS message to the provided phone number. Also, when there is a new outgoing phone call, it will start recording the conversation and save it to a file. Then this file will be sent to the given email address. One interesting thing is that in order to send the recorded phone call to the given email address, GamblerSMS uses a hardcoded email account and the standard SMTP protocol to send email. As a result, all the recorded phone call sent to the monitor's email address will also be in the "Sent Mail" box of the hardcoded email account, which means the author of GamblerSMS will also have a copy of ALL recorded phone calls from ALL victims.

Mitigation:

We found this spyware in an unofficial Chinese Android market. To the best our knowledge, we do not find the threat in the official Android Market. For mitigation, please follow basic, common-sense guidelines for smartphone security. For example,

Follow-ups:

Last modified: July 22, 2011