How Do Mobile RAT Attacks Compromise Smartphones?

TL;DR

Mobile RAT attacks can compromise a smartphone through a browser vulnerability, elevate privileges to root access, install surveillance malware, and connect the device to attacker-controlled infrastructure. The demonstrated Android attack combined a weaponized WebKit bug, a modified public privilege-escalation exploit, and the Nikki Spy APK, showing how an unrooted phone could become a platform for covert monitoring and data theft.

Transcript

Well, as always, it's an absolute pleasure to be at RSA, and we're delighted to be part of the 18-minute rapid-fire session. We're gonna talk a little bit about Hacking Exposed: Mobile RAT Edition, so let's jump into it. My name is George Kurtz. I'm the president and CEO of CrowdStrike, a newly formed security technology company, formerly CTO of Mc... Read More

Key Insights

• A remote access tool or remote access Trojan enables an adversary to control a compromised device with administrative or superuser privileges. Advanced RAT functions described in the presentation include capturing camera video and audio, browsing files, extracting data, and remaining difficult to detect.
• A smartphone is a valuable surveillance target because it contains sensitive information, remains on, includes a camera and microphone, and knows its user's location. A mobile RAT can potentially intercept calls, text messages, and email while also capturing video, audio, and location information.
• The demonstrated attack used spear phishing to deliver malware through a commandeered Chinese RAT. Its scenario targeted a venture capital partner attending the RSA Conference, with the objective of infecting the person's smartphone and eavesdropping on sensitive calls about confidential deals.
• WebKit provided a cross-platform attack surface because the library was used by Android, iOS devices, newer BlackBerry devices, Chrome, and Safari. The researchers demonstrated their exploit on Android 2.2 but stated that the underlying vulnerability was not inherently limited to Android.
• A half-day vulnerability is a bug already fixed in upstream source code but not yet delivered to users through a vendor's firmware update. Such a vulnerability has a shorter useful lifetime than a zero-day, yet remains exploitable while affected users have no available product patch.
• The researchers purchased 20 WebKit half-day bugs for about $1,400 on the gray market. The purchase included no guarantee of exploitability because the sellers promised only that the bugs would crash a WebKit browser, leaving the researchers to determine whether code execution was possible.
• Privilege escalation was necessary because compromising the browser alone did not provide complete control of the device. The team spent about two man-days modifying a publicly available root exploit so it could run from browser control and gain administrative privileges below the application layer.
• The completed attack chain combined a purchased WebKit bug, internal exploit weaponization, a root privilege-escalation exploit, and the Nikki Spy APK. The researchers reverse engineered the Chinese malware and implemented their own command-and-control capability, without requiring the target phone to be previously rooted or jailbroken.

Questions & Answers

Q: What is a mobile remote access Trojan?

A mobile remote access Trojan is malware that allows an adversary to control a compromised smartphone remotely. The presentation describes capabilities including intercepting calls, text messages, and email, capturing video and audio, browsing stored files, extracting data, and tracking the target's location. Such access can turn the phone's communications, sensors, and stored information into sources of intelligence for the attacker.

Q: Why are smartphones effective tools for covert surveillance?

Smartphones combine several characteristics that make them attractive surveillance targets. They are widely used, usually remain switched on, store sensitive information, contain cameras and microphones, and track location. If an adversary gains sufficient control, the device can be used to monitor communications, capture nearby audio or video, collect files, and follow the target's movements without requiring a separate spying device.

Q: How did the demonstrated mobile RAT attack work?

The attack chain began with a spear-phishing delivery mechanism and a weaponized vulnerability in WebKit. After compromising the browser, the researchers used a modified privilege-escalation exploit to obtain root access. That access allowed them to install the Nikki Spy APK. They had reverse engineered this Chinese remote access tool and implemented their own command-and-control system to operate the compromised phone.

Q: What is a half-day vulnerability?

A half-day vulnerability is a bug that has already been fixed in an upstream project's source code but whose patch has not yet reached users through the relevant vendor's product or firmware release. Its useful lifetime is shorter than that of an unknown zero-day vulnerability. However, affected users remain vulnerable during the deployment gap because no applicable device update is yet available to them.

Q: How did the researchers obtain the WebKit vulnerability?

The researchers used a process they called bug shopping to emulate how an adversary might acquire vulnerabilities rather than discover them through fuzzing. They bought 20 WebKit half-day bugs on the gray market for about $1,400. The purchase carried no exploitation guarantees. They knew only that the bugs caused browser crashes, so they had to determine whether one could support code execution.

Q: Why did the attack require a privilege-escalation exploit?

The initial WebKit exploit compromised the browser, but browser control alone did not provide the administrative access needed for broad control of the phone. The researchers therefore modified a publicly available privilege-escalation exploit to gain root access below the application layer. They said this modification required about two man-days and enabled installation of the Nikki Spy surveillance application on the compromised device.

Q: Did the target Android phone need to be rooted first?

No. The researchers explicitly stated that the technique did not require the phone to be rooted or jailbroken before the attack. Their chain first exploited WebKit through the browser and then used a separate privilege-escalation vulnerability to obtain root access. The demonstration was designed for Android 2.2, allowing an ordinary vulnerable device to be compromised without advance modification by its owner.

Q: Why was WebKit significant to the mobile attack?

WebKit was significant because it was an underlying browser library used across several mobile and desktop platforms. The presentation identified Android, iOS devices, newer BlackBerry devices, Chrome, and Safari as WebKit users. Although the demonstration targeted Android 2.2, the researchers said the vulnerability was not Android-specific and could potentially be weaponized against other platforms using the same technology.

Summary & Key Takeaways

• Remote access tools and Trojans give adversaries control over compromised computers and mobile devices. Their capabilities can include capturing camera video and audio, browsing files, extracting data, intercepting communications, and tracking location. Smartphones are especially valuable surveillance targets because they are widely used, always on, sensor-rich, and filled with sensitive information.

• The demonstration targeted an Android 2.2 device through a vulnerability in WebKit, a library also used by iOS, newer BlackBerry devices, Chrome, and Safari. The researchers said Android 2.2 represented nearly 30 percent of Android phones, while version 2.3 represented another 60 percent according to Google statistics dated February 1, 2012.

• The researchers purchased 20 WebKit half-day bugs for about $1,400, then weaponized one internally. They combined the browser exploit with a modified public privilege-escalation exploit to gain root access and install Nikki Spy. The team also reverse engineered the malware and implemented its own command-and-control system for controlling the compromised phone.