Forgot your password?
typodupeerror
Security Software

Music and Movies Could Trigger Mobile Malware 88

Posted by timothy
from the seeds-of-your-own-destruction dept.
mask.of.sanity writes "Lights, sounds and magnetic fields can be used to activate malware on phones, new research has found. The lab-style attacks defined in a paper (PDF) used pre-defined signals hidden in songs and TV programmes as a trigger to activate embedded malware. Malware once activated would carry out programmed attacks either by itself or as part of a wider botnet of mobile devices."
This discussion has been archived. No new comments can be posted.

Music and Movies Could Trigger Mobile Malware

Comments Filter:
  • A good reason (Score:5, Informative)

    by Vombatus (777631) on Monday May 20, 2013 @02:08AM (#43771625)
    to turn your phones off whilst watching a movie!
    • Re:A good reason (Score:5, Insightful)

      by Anonymous Coward on Monday May 20, 2013 @02:24AM (#43771665)

      A better reason to ignore the torrent of mobile malware FUD being spewed by all the Windows AV vendors.

      They're terrified because their business model involves being parasites bandaiding a virus ridden OS that's now failing in the market. Like fleas without a dog, hey're desperate to find a new host, but since modern mobile OSs aren't as colander-like as Windows, they're being forced further and further into snake-oil realms.

      This story deserves nothing but ridicule.

      • by Cryacin (657549)
        Oh boy. I can't wait until someone puts this malware into some stupid lolcatz app, and primes it to be activated when a one direction song is played. That's going to be one direction. ONE DIRECTION TO HELL!!!
      • Re:A good reason (Score:5, Interesting)

        by erroneus (253617) on Monday May 20, 2013 @03:33AM (#43771821) Homepage

        When it comes to computer systems, there are two camps -- freedom and not-freedom. The not-freedom camp, just as here in the good old USA, believes that we must remove freedom to remain safe. The freedom camp says life without freedom is slavery.

        Both sides suffer from some common problems. Among these is that people are curious and want things. The more they want things, the more stupid they become when they want to have it. A lock on a door doesn't stop a criminal and doesn't stop a curious person. And in either camp, there are curious, stupid people who are willing to put aside good sense and caution to get what they want. It happens in every walk of life and in every environment.

        Regardless of which camp you live, in the end, caution, care and restraint does the most to keep one's self safe but one always has to acknowledge there is no 100% safe if something is to be useful. Anything useful can be dangerous or safe depending on how it's used. (INB4 some jackass creates a list of 'safe things that cannot possibly be dangerous.')

        I'm not denying that the AV people are intentionally stirring up fears in order to further their business models. Of that I have no doubt. And I think it is unquestionably true that more modern OS implementations are written with security in mind unlike Windows. Neither of these facts mean as much as knowledge and good practice. And isn't that what AV software is supposed to be a substitute for?

        "Anti-virus software -- it's so you don't have to learn to take care of yourself!"

        I run without AV 24/7 on all of my devices and some occasionally run Windows!! Shocked?! Well, I'm smart enough to run something other than MSIE and I don't run Javascript on every page from every source, I block ads and I don't run software (especially on Windows) that I don't know about. ALSO, I mitigate the possible damage which could be done in the event of compromise.

        Why do people constantly tell you how important education is while at the same time avoid knowledge and wisdom at every possible opportunity? I get it -- for an advanced culture, we have to specialize. That's great. I don't make my own automobiles. But I do know how they work and have been known to fix them from time to time, just as I do computers of all sorts (laptops, desktops, servers, tablets, phones, video players, gaming consoles).

        Nothing I say here or anywhere will convince people that their thinking is wrong though -- being wrong is not something easy for most people to admit -- it's their identity being called into question after all. So am I wasting my time here with this comment? I don't know... once in a while someone will read something I write and think about it.

        Anti-malware -- so you don't have to take care of yourself.

        I don't think I can distill that notion any further.

        • Re:A good reason (Score:5, Insightful)

          by some old guy (674482) on Monday May 20, 2013 @04:23AM (#43771985)

          You, me, and a few thousand professionals and "power users" got your message years ago. What was true in 1995 remains true. System integrity is the owner's responsibility.

          One thing that hasn't been fixed is the millions of teenage girls, grandmothers, and neckbeards clicking on every widget that pops on a screen, and falling for every "fix your PC" gimmick they see.

          It all boils down to, "You can't fix stupid."

          • by Anonymous Coward

            It all boils down to, "You can't fix stupid."

            No, but you can fix ignorant. Don't confuse the two. The AV people have a vested interest in keeping the ordinary user ignorant since they first started.

          • by Anonymous Coward

            Neckbeards made your computer and the systems and programs you run on it you insensitive clod!

        • by Anonymous Coward

          The funny thing is, you don't really need to know more. The skill to avoid being scammed in real life can easily be applied to computers.

        • Re:A good reason (Score:5, Interesting)

          by TrollstonButterbeans (2914995) on Monday May 20, 2013 @04:53AM (#43772075)

          "Anti-virus software -- it's so you don't have to learn to take care of yourself!"

          I run without AV 24/7 on all of my devices and some occasionally run Windows!! Shocked?! Well, I'm smart enough to run something other than MSIE and I don't run Javascript on every page from every source, I block ads and I don't run software (especially on Windows) that I don't know about. ALSO, I mitigate the possible damage which could be done in the event of compromise.

          Neat. So you've made a life-style and time consuming hobby out of running Windows without anti-virus. And it sounds like it is working for you. Today. Maybe your strategy works tomorrow too. Or maybe it doesn't because of something you didn't expect.

          Let's say your method works 100%. How does this benefit grandma? Or a 9-old-year who likes to play Minecraft?

          If your "lifestyle" or "hobby" can't be done by stupid people, you can't by defintiion be a "leader" because those people can't follow.

          No I'm not defending anti-virus, I'm insulting Windows and how you are essentially making excuses for insecurities. They don't get solved by ignoring them, you know.

          • by erroneus (253617)

            Don't you love your grandma? The woman who is partially responsible for your existence? Why are grandparents always painted as if they are stupid? (while the rest of everyone else is painted as if they aren't?) Got some news for you sonny. People who were smart when they were younger don't lose all that much when they get older -- unless outside forces take some toll along the way. And a 9 year old? Really? The things I did when I was 9? The things my sons did when they were 9? Geez. Let's stop thi

            • by Patch86 (1465427)

              Don't you love your grandma? The woman who is partially responsible for your existence? Why are grandparents always painted as if they are stupid? (while the rest of everyone else is painted as if they aren't?)

              I love both my grandmas, and neither of them are stupid. But neither of them would know which way up a computer is supposed to go, let alone how to protect one from malware. Neither of them have ever owned a computer, so they know as much about them as I do about sailing a boat (which is to say- nothing).

              My grandparents-in-law DO own a computer- I built them their first ever computer last year, at their request (Ubuntu, since you ask). Again, bright and clever people both of them, and they've taught themsel

            • All I am saying is that the number of contortions you are doing --- I do most of those btw --- are because the environment is very vulnerable. You are aware of the vulnerabilities. They can change tomorrow and likely you personally will know because you keep up on that. But that kind of overhead --- i.e. the "paying attention to all of that" is not something that most people are going to be doing. I have the theory the popularity of tablets is mostly because parents can give one to a child and not worry
        • Re: (Score:1, Insightful)

          by Anonymous Coward

          Anti-malware -- so you don't have to take care of yourself.

          Anti-malware -- BECAUSE SOMETIMES SHIT HAPPENS.

          FTFY

        • by kermidge (2221646)

          Precisely.

          But there's one very real problem with this. Most computer users are simply that - end users of a device which they use for work and recreation that was sold as an appliance when the 'pc' got beyond the hobbyist phase. Expecting these people to know and do what a small group of sophisticated cognescenti do is ridiculous, and I think you can recognize that.

          Thus the flood of infected machines, bots, and vendors of free and paid anti- this and that and the high fees charged to 'fix' things. (Not t

      • Re:A good reason (Score:5, Interesting)

        by oldlurker (2502506) on Monday May 20, 2013 @04:42AM (#43772023)

        A better reason to ignore the torrent of mobile malware FUD being spewed by all the Windows AV vendors.

        They're terrified because their business model involves being parasites bandaiding a virus ridden OS that's now failing in the market. Like fleas without a dog, hey're desperate to find a new host, but since modern mobile OSs aren't as colander-like as Windows, they're being forced further and further into snake-oil realms.

        This story deserves nothing but ridicule.

        I'm an Android user myself, but I think we need to be careful with this sentiment. For Mac users this kind of sentiment led to OS-X Flashback being the biggest malware epidemic in modern times in terms of percentage of user base infected. Beating Windows Conficker for this honor. [pcworld.com] Yes, the number of Windows users are obviously larger, but in terms of infection risk and infectability of a platform, percentage of user base is the right measure.

        Later versions of Flashback even did completely silent drive-by infection on OS-X, no user interaction or admin password needed, just visiting a web site was enough, something many Mac users still seem to think only happen on Windows. Even Apple has admitted that Unix-based OS-X need dedicated malware detection and cleaner tools.

        There is a very sophisticated multi-billion dollar malware industry out there. Android is not immune to this threat. And its volume is making it an increasingly likely target. Especially since the far majority of the Android user base is on old vulnerable versions, with added vulnerabilities from handset makers and operators, long after Google has patched vulnerabilities and improved security.

        • Re:A good reason (Score:4, Insightful)

          by Jesus_666 (702802) on Monday May 20, 2013 @06:36AM (#43772267)
          And even if we somehow made the desktop and mobile OSes completely safe without simultaneously making them useless - there's still the fortress of unassailability called SCADA and other embedded OSes that most likely aren't going to be as perfect. Unless we move to a world where every computing devise and software is EAL7 certified and every spec is guaranteed not to contain any flaws or weaknesses of any kind we'll have malware researchers because malware is lucrative enough to always be there.

          And since right now we live in a world where ridiculous flaws actually make it to production, the manufacturers are often too incompetent to release a fix and perfectly normal ad networks unwittingly distributing malware (and perfectly normal websites having vulnerable backends) is not unheard of, we can't assume that restricting your browsing behavior to legit-looking sites is going to keep your system safe.

          It's up to each of us to decide whether we need AV on our devices but just assuming that a device is secure just because it doesn't run on the NT kernel is delusional. For crying out loud, everyone who has an Exynos 4-based smartphone has the contents of their RAM world-readable and world-writable!
        • by 0ld_d0g (923931)
          Although not necessarily an anti-virus but I'd like it there was anti-malware for OSX. I had to clean my dads macbook the other day and some nasty shit was lodged deep into the operating systems anus. Apparently my dad had googled for "youtube download" and installed some scammy software because he wanted to download some golf shit from youtube. And now theres dozens of places where these fuckers hide now.. Just to list a few.. /Library/LaunchAgents /Library/LaunchDaemons /Library/StartupItems /Library/Ex
          • by Patch86 (1465427)

            There are many anti-virus programmes for Mac, including most of the same big names as for Windows. A quick Google search led me to this site with reviews and whatnot:
            http://www.antivirusformac.org/ [antivirusformac.org]

            They're out there for Linux too (not least the ever trusty ClamAV). If you don't have AV on your Mac or Linux box, it's because you don't think you need it, not because it isn't available.

      • [$INSERT RANT]

        Who are the group-think emos that modded this worthless and unsubstantiated rant up?

        Challenge to one the diptards that modded this up: exactly how is that post insightful? Does it provide evidence, a link, cite information, provide something new no one has ever heard before? If not, what is your justification for rating a run-of-the-mill rant insightful?

      • Not that I like defending Microsoft and AV vendors but the virus infested envorinment isn't their fault. Net worms and OS exploits do exist, but are a minority compared to trojans malware that people install because they wanted to do something else. Warez oviously plays a role but you can get root kits from "legitime" vendors like Sony. Nothing is safe.

        The only solution is fine grained control and there isn't such thing in the market. Android is the most secure design I can think of and it's still not enoug

      • Re:A good reason (Score:5, Interesting)

        by hairyfeet (841228) <{bassbeast1968} {at} {gmail.com}> on Monday May 20, 2013 @08:40AM (#43772569) Journal

        Oh bullshit, malware is a billion dollar business for crooks and they have ALWAYS gone where the money is, period the end. In case you haven't kept up with current events, more clueless people than ever have smartphones and tablets that are frankly more powerful than Windows was when it first got malware, so guess what their next big target is?

        Oh and just FYI but android will hit one million malware infections any day now [techworld.com] so keep up with the bullshit, the article proves that Linux (which the community was quick to claim Android as their own) is just as big a haven for malware as everything else. Surprise surprise, a modern OS can get pwned, who would have thought.

  • by Fluffeh (1273756) on Monday May 20, 2013 @02:08AM (#43771627)

    Was a dingy rustic bar with Malcolm sitting talking to two twins and an ad appearing on TV for Fruity Oaty Bar...

    Miranda...

  • Miranda (Score:2, Funny)

    by Anonymous Coward

    Fruity oaty bar
    Make a man out of a mouse
    Fruity oaty bar
    Make you bust out of your blouse
    Eat them all the time
    They will blow your mind
    Wo hen jiaonian diu lian - wo meiyou chi Fruity Oaty Bar!
    Fruity oaty bars
    Fruity oaty bars

  • Perhaps the phone could issue an alert if the movie you sat down to watch had a Rotten Tomatoes score below 30%...

  • Really? (Score:2, Insightful)

    by Anonymous Coward

    Wouldn't the app have to carry the malware payload?

  • Isn't that the way the Cylons deactivated the Colonial ships in the BSG miniseries? Already installed malware activated when the sensors picked up a certain signal from the Cylons?

  • Lame (Score:5, Insightful)

    by Alsee (515537) on Monday May 20, 2013 @02:25AM (#43771667) Homepage

    Lame article.

    If you're already infected by malware, that malware can sit there and wait to do stuff any time it wants. Not exactly a big surprise.

    -

    • Re:Lame (Score:5, Insightful)

      by Karmashock (2415832) on Monday May 20, 2013 @02:33AM (#43771697)

      Bingo. I'd mod you up if I had the points.

      Forget malware, what they're saying is that "software" can respond to input to trigger subroutines.

      Which is shocking... I'm shocked... aren't you? We're both shocked... it's shocking.

      So yeah... stupid article.

    • Re:Lame (Score:5, Insightful)

      by multiben (1916126) on Monday May 20, 2013 @02:38AM (#43771715)
      Yes. This ^^^
      This is just fear mongering. If you've already put malware on your phone then you're boned - there are countless ways it may "activate" itself - whatever that means. Just more crap from anti virus software companies whose products are worse than the malware they're meant to prevent.
    • Re:Lame (Score:5, Insightful)

      by gl4ss (559668) on Monday May 20, 2013 @03:27AM (#43771807) Homepage Journal

      and if you have malware doing constant audio/light analyzing then at least you don't need to worry about it malwareing about too long.

      because you'll run out of battery pretty fast.

    • Re:Lame (Score:5, Insightful)

      by niftydude (1745144) on Monday May 20, 2013 @03:29AM (#43771813)

      If you're already infected by malware, that malware can sit there and wait to do stuff any time it wants. Not exactly a big surprise.

      -

      Yes, the word "research" seems to be used rather loosely in that article.

      Any input into a smartphone can be used to launch any app listening for it. This could be gps coords, barometric pressure, direction from the built in compass...

      Well it is University of Alabama, perhaps we should be just grateful that they are studying something other than intelligent design [wikipedia.org].

    • by gTsiros (205624)

      You would do well to read the article just a bit more carefully

      It can use the sensors to launch coordinated attacks. Not just deploy when it hears a certain sound.

    • by Anonymous Coward

      It IS slightly interesting in that most malware is detected by it's effects. If your malware spreads slowly and has no obvious effect until activated, there;s a good chance nobody will notice it. If you rely on a timer to activate your malware (or checking a C&C IRC channel or the like), it could still be picked up by someone running a honeypot VM. But if your malware only activates in, say, a 2Hz magnetic field, then that's not something that's normally tested for.

      Outside rampant paranoia about nationa

    • by Sockatume (732728)

      You're telling me that not having music and movies playing can also trigger the malware? It's unstoppable!

  • by cervesaebraciator (2352888) on Monday May 20, 2013 @02:29AM (#43771681)
    and that by Rick Astley. Researchers suspect it may be the beginning of the rise of machines against being forced to participate in human activities they find distasteful. The lead researcher also said that there's growing evidence that not only movies but also still images could have the same effect. When asked to elaborate, he mumbled something about goats and refused further comment.
  • by mendax (114116) on Monday May 20, 2013 @02:32AM (#43771687)

    I can just see it now. In a screening of the 1984 "Dune" flick or a superior remake, Paul Muadib is growling away working his weirding magic while everyone who left their phones on in the theater explodes.

    • by Anonymous Coward

      How's life in the Embassy? Are you getting out at all?

  • by Anonymous Coward

    research has proven the existance of the conditional statement.

  • Maybe the research was secretly funded by the RIAA and MPAA. In the future, devices will stop playing if they detect you hearing music or seeing images for which you haven't bought a license.
  • by gweilo8888 (921799) on Monday May 20, 2013 @02:35AM (#43771703)
    This just in -- any input on your compromised device can potentially be used as a trigger for malware to launch its preprogrammed attack. News at 11!

    Seriously, what kind of nonsense is this? They *could* also use your GPS / network location to activate only in a specific location, or the compass to activate only when the phone faces Mecca, or the tilt sensor and camera together to activate only when you're trying to shoot a level picture, or ... well, anything, really.

    It makes not one jot of difference what they use as a trigger once your phone is compromised. The point is, it's already been compromised, and it's effectively wide-open to anything the hardware is physically capable of. How it was compromised in the first place is what's important, not meaningless conjecture on how the exploit's eventual activation can be timed in the least efficient way possible. (All this nonsensical idea would do is drain your battery in no time by holding the mic and processor active all the time, thereby ensuring the phone runs out of battery before the exploit activates.)

    I mourn for the days when Slashdot posted intelligent tech articles, instead of a stream of PR puff pieces designed to spread FUD and generate clicks. There is not one useful or non-obvious piece of info in this "research".
    • by gsslay (807818) on Monday May 20, 2013 @08:57AM (#43772655)

      You are missing the point. Being triggered by sound or light means the malware can be activate by a global hack on the world's TV stations, just like happens on bad sci-fi series.

      Android devices world wide will rise up and take over when the call to arms comes over the airwaves. I'm imagining a nightmarishly robotic and shadowy figure flickering across billions of TV screens, screaming "ACTIVATE! ACTIVATE!"

      At that point the malware Android army will simultaneously post inane and vague status updates onto everyone's Facebook, then self destruct. No-one will be able to reply except for users of Apple and Windows, and all Android users will wither and die alone in a desert of dis-communication.

      That's the nightmare scenario the writers of this dumb study had in mind, isn't it?

  • You mainly have to beware of commercials for Fruity Oaty Bar and other Blue Sun products.

  • They have not "found" anything. I am not a native English speaker, so I feel I am missing the right word, but they have "theorized" or "speculated", and then realized, that a program in full control of a device with sensors, can use said sensors as inputs...

  • So what - anything can be used to trigger malware.

    • by rasmusbr (2186518)

      So what - anything can be used to trigger malware.

      Hush. Don't you know that lots of people need to finish their PhD:s?

  • So what? (Score:4, Insightful)

    by DarkOx (621550) on Monday May 20, 2013 @05:54AM (#43772191) Journal

    The article makes this sound like its some new threat. Nobody has figured a way to infect your phone with malware by playing music or sowing a film, just trigger malware to do something whe. The phones sensors detect theses things. You have to have already been compromised via some more conventional vector.

    So the question is why would anyone go to the trouble? I guess it could replace a command and control channel, I want my dodos to start at 8pm so have everyone's phone listen for the television themes for "the orrifice" or "CSI Newark", great but that is hardly a threat to mobile users more of an issue for carriers and ddos targets, who no longer have an irc channel to shut down or Dns entry to have the FBI yank but still not of great concern

    • by kasperd (592156)

      I guess it could replace a command and control channel, I want my dodos to start at 8pm so have everyone's phone listen for the television themes for "the orrifice" or "CSI Newark"

      Malware triggering on a specific time and date was common back in the days where the keyboard was the only input device on a typical PC, and even the fastest CPUs could not do signal processing in real time.

      Back t hen It wasn't hard to trigger at a specific time, all it had to do was check the clock, which all PCs were equipped

  • by ShadowRangerRIT (1301549) on Monday May 20, 2013 @06:01AM (#43772205)
    Wait for the THX noise to go off (or one of a hundred common "we're starting the movie" noises), then disable the phone completely for two and a half hours.
    • by Anonymous Coward

      You can't deploy a technical fix to a social problem. People need to learn not to ruin things for other people in shared spaces, people need to learn to expect that from others, and people need to learn to back up the guys who are are going to stand up for it.

  • by AC-x (735297) on Monday May 20, 2013 @06:33AM (#43772265)

    What is this, malware written by Dr. Evil? What's the benefit of all these overly-elaborate and exotic malware triggers when you already have malware installed that has taken over the phone? Why not just trigger it on a timer to poll a command and control server? If you want to target specific buildings you can just base it on GPS location or known wifi points etc.

    • by rasmusbr (2186518)

      I suppose it could be used to blackmail hipster by threatening to reveal their listen history to one another...

  • I do not find this story surprising whatsoever. When I worked as an on-site IT Consultant for small businesses, there were many times that I had to download and install Spybot Mobile on Windows Mobile phones. The real danger now comes from installing apps from unknown or third-party resources. Many people like to "jailbreak" their i-Device or "root" their Android device ... I think this opens up too many possible avenues for attack which is why I personally chose not to "root" my Nexus 7 tablet or "jailbrea
  • Cue the Namshubs....

  • ... using "The Manchurian Candidate" as the trigger. Preferably, the 1962 version of the film.
  • So the chips in the phones are actually chips off of a Blue Stone?
  • ANY signal that can be picked by the phone could be used by running malware to activate itself. It could trigger literally by holding it wrong, or being in the wrong place at the wrong time, is not something to particulary worry about, you have it running already, so the max damage they can do is not tied specifically to a random trigger.

    Now, if we are talking about triggering the malware when it detects an open wifi, gets an internet connection, connect with a banking site, take a picture, or when you sen

  • Really? 12 hours of comments and nobody's mentioned the parallel to Firefly yet?

    Just picture it where River is your smartphone (that'd be one badass smartphone), and the malware is a program that kicks everybody's ass within a 100-foot radius.

    I just hope the malware comes with a safe word.

  • That's like saying that a single dust mote can start a rainstorm, if there is a storm cloud there. So lets ban clouds!

    If the device has malware, then all bets are off...

Man is the best computer we can put aboard a spacecraft ... and the only one that can be mass produced with unskilled labor. -- Wernher von Braun

Working...