Feeds

Navy devs cook up Android spyware to map your location - in 3D

Smartphone snooper stakes out the joint as you move around the room

Choosing a cloud hosting partner with confidence

Indiana students working with the US Navy have demonstrated malware capable of mapping a room and creating a 3D-navigable space to help information thieves find what they're looking for.

The Indiana University team, which includes a representative from the Naval Surface Warfare Center, created PlaceRaider – smartphone software which covertly takes snapshots every two seconds and then runs those snaps through existing analysis software to create a 3D model, which enabled users to find bank details, snatchable property and even when the residents were likely to be out.

The idea is that the software, called PlaceRaider, could be embedded into any of the camera-enhancement applications already available in the mobile app marketplaces, providing it with all the permissions it needs to carry out the attack. Once installed, PlaceRaider runs in the background, covertly taking snaps opportunistically as the user moves around the room with the phone. The malware mutes the volume before every snap to prevent the shutter sounding. Along with the pics, the camera records its orientation to help it build the 3D model later.

Obviously useless snaps are then discarded – which amounted to almost three-quarters of them in testing – and the rest are sent back to the miscreant along with the orientation data. All that data is then run through the Bundler toolkit - a stitching package following on from Microsoft's legendary Photosynth application, which glues together unrelated photos of the same subject. The result of that is run though the open-source Patch-based Multi-view Stereo Software to create a 3D navigable space.

It's not quite that easy, in the detailed write-up (PDF, detailed and well written) the team points out that Photosynth can rely on most pictures being horizontally aligned (as they come from Flickr, or are at least deliberately taken) while their samples were at all sorts of angles though they did have the orientation data to help address that.

The point of the process was to make it easier for the miscreant to find stuff worth seeing, so the team set a room with a decent amount of data on display (cheques on the desk, a wall calendar carefully noting foreign travel, and so forth). Twenty students were then asked to complete normal mobile-phone takes on an infected HTC Amaze, without knowing the true purpose.

Once the data had been gathered, another group of students were asked to see if the data contained anything useful, with half being given the raw images (between 800 and 1,400 of them per sample) and the other half getting the 3D experience. Unsurprisingly those able to visualise the space made a much better job of finding the data, showing the analysis was worthwhile.

That's nothing to panic about right now, the process was complicated and the threat indeterminate (take a look around you now, decide what in the vicinity would be of value to a thief, and realise the threat isn't really credible just yet), but that will change as the processing power of the phone increases (enabling it to filter out more information) and more bandwidth becomes available.

It was lack of bandwidth which prevented the team from using video, but the implications are obvious. Web cams have been hijacked many times, but they generally point in one direction and thus have limited value for snooping. A mobile-phone camera gets a decent sweep of the room every time a call is answered, increasing the risk hugely.

The PlaceRaider team recommend removing the ability to mute the shutter sound (which they do by reducing the volume, as Android already insists in playing it every time a photo is taken) and limiting access to orientation data, though they also admit that a PlaceRaider-detector would be trivial to write and that anti-malware software might become increasingly necessary as the cameras we carry around start being used against us. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Nexus 7 fandroids tell of salty taste after sucking on Google's Lollipop
Web giant looking into why version 5.0 of Android is crippling older slabs
Be real, Apple: In-app goodie grab games AREN'T FREE – EU
Cupertino stands down after Euro legal threats
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
SLURP! Flick your TONGUE around our LOLLIPOP – Google
Android 5 is coming – IF you're lucky enough to have the right gadget
Microsoft: Your Linux Docker containers are now OURS to command
New tool lets admins wrangle Linux apps from Windows
Bada-Bing! Mozilla flips Firefox to YAHOO! for search
Microsoft system will be the default for browser in US until 2020
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.