How Your Phone Camera Can Be Used to Stealthily Spy on You: Transplantation Attacks against Android Camera Service

摘要: Based on the observations that spy-on-user attacks by calling Android APIs will be detected out API auditing, we studied possibility of a "transplantation attack", through which malicious app can take privacy-harming pictures to spy users without auditing being aware it. Usually, picture, apps need call Camera Service runs in mediaserver process. Transplantation attack is transplant picture taking code from process process, and this its own address space any IPC. As result, evaded. Our experiments confirm transplantation indeed exists. Also, makes much more stealthy. The evaluation result shows nearly half 69 smartphones (manufactured 8 vendors) tested let discovered us succeed. Moreover, evade 7 Antivirus detectors, Device Administration set used carry mobile device management enterprise environments. inspires uncover subtle design/implementation deficiency security.