Android Backdoor GhostCtrl Can Silently Record Your Audio, Video, and More
blog.trendmicro.com
blog.trendmicro.com
"The malware masquerades as a legitimate or popular app that uses the names App, MMS, whatsapp, and even Pokemon GO. When the app is launched, it base64-decodes a string from the resource file and writes it down, which is actually the malicious Android Application Package (APK)."
The user has a legitimate expectation that the app sandbox containment provided by the OS works and nothing bad should happen if s/he tries out the aforementioned apps.
This type of malware are commonly called backdoors, see eg. http://www.virusradar.com/en/glossary/backdoor
I agree with @debatem1, this is not what "backdoor" commonly means, phishing does not count as "without the user's knowledge". Phishing is a trick to get in the front door.
The user wanted to install a WhatsApp, Pokemon, etc type of application but was phished or otherwise deceived into completing the app installation interaction, and was left with no knowledge about the backdoor.
I'm sure there are gray areas and situations where it's hard to distinguish, but a backdoor is most commonly defined as not involving any user interaction. A phishing attack involves user interaction. The phishing attack can be used to install a backdoor for future attacks, but that's not what happened here. This phishing attack asked the user for permission to do the things it wants to do. That's the front door.
It's a guy pretending to be the mailman ringing the doorbell and asking if he can come in, then stealing stuff while he's there. The backdoor is a thief in a mask sneaking in a slightly open window at night when nobody's home. The difference is the fake mailman asked for permission. Even though he was fake. It wasn't my intent to let a thief in the house, it was my intent to let the mailman in, but I still got robbed.
Make sense now?
This distinction is important because there are things you can do to avoid phishing, as there are in this case, but there is nothing you can do to avoid a real back door, because it happens without any signaling at all, it happens without your knowledge. So back to @debatem1's point, this should have been called a sophisticated phishing attack, rather than being called, inaccurately, a back door attack.
There is always some infection vector associated with a backdoor.
The definition of a backdoor is an attack that bypasses security and doesn't require user input. The definition of phishing is an attack that requires user input, by tricking the user into using their own credentials to authorize access.
Back doors can be opened intentionally or unintentionally by whoever designed or setup the system, but they allow an attacker to get in without involving any input or action from a legitimate user of the system.
Phishing is a way to infect a device with malware by tricking the user into installing the malware. That's exactly what happened here. GhostCtrl is malware that infects via phishing, because it requires the user to authorize it, and it does not have an attack vector it can use without the user's authorization.
It sounds like we're all straightened out and in agreement?
Yes, there is a type of back door that is factory installed as part of the dev process of an otherwise legitimate product. But in the context of malware, the backdoor is a payload that enables malicious remote access. Like the glossary entry I linked explains.
The miscommunication here between us is that you're looking at what GhostCtrl does after it already gained access. Because the first point of contact, the initial entry point, is using the security systems as they were designed to be used, and tricking the user into granting access to the malicious software, the attack as a whole is a phishing attack. As I understand it, the payload is not by itself elevating access, it is using access the user granted to do bad things, not achieving a higher access level.
The payload of an attack of any sort is not commonly understood to be the "back door", I think you're slightly off the mark there. You're not wrong, but you're going to have trouble talking to other people if you keep insisting on this, because the common understanding of a back door is that it's a way of getting in, by bypassing security. It's normally defined as a way of initiating an attack, not the malicious result of an already complete attack.
The only way to define a back door as you have is to have another attack in front of it. If the back door is the payload, then you have to deliver and execute the payload somehow. In the case of GhostCtrl, that mechanism is phishing.
Any payload is not a back door, payloads can be also ransomware, ddos bots, etc.
FWIW, I don't think that glossary entry you linked is very good. It calls a backdoor an application, but a backdoor is not always an application -- which I think you already know & mentioned in this thread. A RAT (remote access tool) is definitely not synonymous with backdoor in the common understanding. A backdoor can also be an open port, a bad password, or a variety of other entry methods. Wikipedia's entry on backdoor is better than the one you linked. https://en.m.wikipedia.org/wiki/Backdoor_(computing)
If a backdoor were always an application, and that was the common definition, then I think the question above wouldn't have been asked. One problem is that backdoor sometimes implies a vulnerability exists before any malware is installed. To call something a backdoor can send the wrong message about what someone concerned about this should do to mitigate the risks. Knowing it's a phishing attack is pretty important because it means you can and should be suspicious of apps asking for credentials and permissions. If you think it's primarily a back door, you might wrongly assume that you need to update a security patch, or that there's nothing you can do to reduce your risks.
This is why I believe @debatem1's question is reasonable and agree with it - to title this a backdoor is technically true, but it seems misleading.
They tend to litter all their discoveries with FUD in order to maximize their sales.
OK, so the attack vector here is installing dodgy stuff off the Play store? Or not the play store but from another source, such as an ad?
It is still more dangerous, but known signatures are detected.
>GhostCtrl is also actually a variant (or at least based on) of the commercially sold, multiplatform OmniRAT that made headlines in November 2015.
"Hacked Up Pokemon Go needs thse permissions" (all of them) (deny, allow), user has been trained that if they deny a permission the app won't work so they click allow?
Each individual permission is prompted for and can individually be denies.
I personally consider this an improvement, though I realize many (probably most) users will just click through anyway.
The permissions system was introduced on 6.0.
That's what I actually do. I refuse to install apps that require broad permissions not related to their primary purpose. Though I do realize that I belong to that insignificant minority group of users.
On Android 6 or newer you can always deny permissions, even if the app targets older Androids. (Settings -> Apps -> <app> -> Permissions).
Every time I install something I have a sinking feeling as it asks me to allow it to do things that sound wildly beyond anything I would ever want an app to do. Things like an app for my kids that asks for something along the lines of "access to the files". Hopefully things have improved with the newer OS but man I feel uncomfortable installing apps on Android in a way I've never felt with Apple.
Android prompts info about whats happening, iOS just ignores them and keeps going.
With this simple difference, people tend to think iOS works better! I cannot trust an OS that doesn't ask me stuff, or takes things for granted.
Best example is the "Force close" dialog on Android vs just crashing the app on iOS.
http://cdn.wccftech.com/wp-content/uploads/2017/03/icloud-sc...
http://www.jordantimes.com/sites/default/files/styles/news_i...
etc
Usually show men in black clothes trying to climb in windows, etc.
I wonder how many people would believe that works.