Call-Recording Android Trojan

Earlier this week, Total Defense security researcher Dinesh Vinkatesan broke news of a pernicious-sounding security threat for Android devices. According to Vinkatesan's post on the CA Security Advisor Research Blog, this threat is a Trojan horse malware application capable of recording a user's phone calls and uploading them to a remote server.

It sounds pretty bad. And it would be, if it were true. But according to new information released today by Symantec security analyst Irfan Asrar on the Symantec Security Response Blog, the threat known as Android.Nickispy doesn't look so menacing after all.

In the Monday blog post that launched this story, Dinesh Vinkatesan was less than revealing about the source of the app, saying only, "today we have received an Android package to our collection and observed that this piece of malware walks an additional mile by having a neat configuration and has a capability to record the telephonic conversation the infected victim makes." With that kind of description, it's no wonder security-conscious tech audiences took a keen interest in this package.

According to Symantec's Irfan Asrar, however, the app is widely available on multiple sites in China, with no effort made to conceal its function. "The author had clearly stated the purpose, so anyone installing this app could not be mistaken in its intentions," said Asrar. "Now that's not to say someone couldn't install it on another person's phone. Still, on completion of installation the app actually shows up with an icon marked Speech Recorder, clearly visible to the user." So if you were worried that such an app might surreptitiously appear on your device, breathe easy.

More surprisingly, Asrar said Symantec has found no evidence of the app's ability to upload calls to a remote server. "It can record calls; however, physical access to the device is required in order to retrieve them," said Asrar. The worst this app can do is upload GPS, SMS, and call logs.

While the case of the call-recording "Trojan" appears pretty open-and-shut, it does--as my colleague Laurianne McLaughlin pointed out, highlight a pervasive problem of trust with mobile security. While it's unfathomably unlikely that anyone would ever inadvertently install this app on their own device, it's conceivable that someone else could install something like it without their knowledge, burying the icon in a cluttered applications list. In such a circumstance, an app like this could go unnoticed for days, possibly weeks, betraying the phone's owner at every turn.

The silver lining to this story--if we can call it that--is that the app doesn't even work as advertised. The Symantec team was able to track down the author of Android.Nickispy through questions posted to an Android developer forum. "By doing an online search on the crash details accompanied in the error logs, we found a posted crash dump of the exact same issue," said Asrar, "where a developer was asking for urgent help with the code he or she was working on. A closer look at details of the posted crash dump showed that it had the same package name used in the threat." Despite the year that has passed since the app's author posted that query to the dev forum, Asrar said, "it's still crashing most of the time on a real phone."

InformationWeek Analytics is conducting a survey on mobile device management and security. Respond to the survey and be eligible to win an iPod Touch. Take the survey now. Survey ends Aug. 5.