PlaceRaider Builds a Model of Your World With Smartphone Photos 120
Hugh Pickens writes "Neal Ungerleider writes about PlaceRaider, a trojan that can run in the background of any phone running Android 2.3 or above, and is hidden in a photography app that gives PlaceRaider the necessary permissions to access the camera and upload images. Once installed, PlaceRaider quietly takes pictures at random that are tagged with the time, location, and orientation of the phone while muting the phone's shutter sound. Once pictures are taken, PlaceRaider uploads them to a central server where they are knitted together into a 3D model of the indoor location where the pics were taken. A malicious user can then browse this space looking for objects worth stealing and sensitive data such as credit card details, identity data or calender details that reveal when the user might be away. If a user's credit card, bank information, or personal information happen to be out in the open — all the better. — the software can identify financial data, bar codes, and QR codes. End users will also be able to get the full layout of a victim's office or room. The good news? PlaceRaider isn't out in the wild yet. The malware was built as an academic exercise by a team at Indiana University as a proof of concept to show the invasive potential of visual malware beyond simple photo or video uploads and demonstrate how to turn an individual's mobile device against himself (PDF), creating an advanced surveillance platform capable of reconstructing the user's physical environment for exploration and exploitation. 'The message is clear — this kind of malware is a clear and present danger. It's only a matter of time before this game of cat and mouse becomes more serious.'" As malware, it's spooky. But merely as software, this kind of intelligent 3-D imaging is something I'd like to be able to do with my phone.
Muting camera... (Score:2, Interesting)
...while muting the phone's shutter sound.
Many Android phones require root privilege to mute shutter sound...Some of them allows screenshot of camera preview without it...but not all of them...rooting methods usually differ from phone model to model, and becoming more and more advanced. Some phones have security features like custom LSM modules, NAND tamper checking on boot, or MDM tools built into the kernel. I wonder how this malware dodge this problem.
A call for hardware on/off switches (Score:3, Interesting)
This is why I/O components need hardware on/off switches.
The radio(s), the screen, the touch surface, the camera(s), the speaker, the microphone, the buttons other than of course the "buttons on/off" button need to be either hardware controlled or controlled by immutable, bug-free software.
If I flip the "camera" switch to off, it should be off, and no software in the world should be able to turn it on.
Ditto the cellular radio, wifi, screen, speaker, touch surface, most of the buttons, etc. etc.
If the phone has a master power off button or switch, turning it off should be pretty much like removing the battery except the "turn phone on" button would still work. Not even the "wake on alarm" or "wake on LAN" functions should work. If you need those functions, use the "regular" on/off button, not the "master on/off" button or switch.
Computers and other electronics should have similar on-off buttons. At a minimum, they should have a "master power" button and, typically, a "normal" on/off button. "Normal" being what we normally think of as "on/off" - most functions off but a few, like wake-on-certain-events, turned on.
Re:Pocket (Score:2, Interesting)
They could probably simply solve this by making it take pictures at certain intervals and then only submit the ones that have reasonable light to the server. This could of course eat some processing power, so you may notice battery life decrease.
If you gonna keep your phone in your pocket forever, fine, you won, but what use does it have?
Actually even that may not be enough. If you can have the locations figured out, that could possibly be enough to make a rough sketch of the house you live in. GPS and 3G locations, add them all together and you may be able to figure out the room layout, special locations like the toilet (even if you just want to annoy a person, figure out when he is on the toilet and then ring his doorbell), you could probably do a good guess on the bedroom (phone doesn't move for several hours?), kitchen (room repeatedly gone to around usual eating hours?).
Among other things like when you are out of house often.
Being able to aggregate lots of data on lots of people at the same time would be very nice as a criminal/government.
Re:Accurate measurements? (Score:5, Interesting)
Have you tried 123D Catch from Autodesk? It builds a 3D model from a few photos. Free:
http://www.123dapp.com/catch [123dapp.com]