Creepy Smartphone Malware Re-creates Your Home For Stalkers
from the whose-side-are-you-on? dept
It's become something of a cliché that anyone with a mobile phone is carrying a tracking device that provides detailed information about their location. But things are moving on, as researchers (and probably others as well) explore new ways to subvert increasingly-common smartphones to gain other revealing data about their users. Here's a rather clever use of malware to turn your smartphone into a system for taking clandestine photos -- something we've seen before, of course, in other contexts -- but which then goes even further by stitching them together to form a pretty accurate 3D model of your world:
This paper introduces a novel visual malware called PlaceRaider, which allows remote attackers to engage in remote reconnaissance and what we call virtual theft. Through completely opportunistic use of the camera on the phone and other sensors, PlaceRaider constructs rich, three dimensional models of indoor environments.
The use of 3D reconstructions overcomes a potential problem with ordinary spyware: there's often too much data whose significance is unclear. That makes finding anything interesting hard. The solution here is to combine all the data into a unified, virtual reconstruction that can then be navigated by snoopers looking for significant items just as they might if they were rooting through your physical space.
The full academic paper "PlaceRaider: Virtual Theft in Physical Spaces with Smartphones" (pdf) makes for fascinating reading, even if it doesn't seem to understand the difference between "theft" and "surveillance". It includes the following rather fanciful description of how this 3D-spying capability might be used. It's rather over the top, but it gives an idea of what's theoretically possible:
Alice does not know that her Android phone is running a service, PlaceRaider, that records photos surreptitiously, along with orientation and acceleration sensor data. After on-board analysis, her phone parses the collected images and extracts those that seem to contain valuable information about her environment. At opportune moments, her phone discretely transmits a package of images
to a remote PlaceRaider command and control server.
Well, maybe not. But what's more interesting is the way that smartphone malware is able to gather enough information to allow the detailed reconstruction of complex spaces. The paper includes some impressive 3D reconstructions from apparently random images that have been stitched together. These and the research project that produced them are a salutary reminder that useful as they are, smartphones also bring with them new dangers that need to be considered and, ultimately, addressed.
Upon receiving Alice's images, the PlaceRaider command and control server runs a computer vision algorithm to generate a rich 3D model. This model allows Mallory, the remote attacker, to immerse herself easily in Alice's environment. The fidelity of the model allows Mallory to see Alice's calendar, items on her desk surface and the layout of the room. Knowing that the desktop surface might yield valuable information, Mallory zooms into the images that generated the desktop and quickly finds a check that yields Alice's account and routing numbers along with her identity and home address. This provides immediate value. She also sees the wall calendar, noticing the dates that the family will be out of town, and ponders asking an associate who lives nearby to 'visit' the house while the family is away and 'borrow'; the iMac that Mallory sees in Alice's office.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: 3d imagery, malware, mobile, surveillance
Reader Comments
Subscribe: RSS
View by: Time | Thread
dumb ass says what.
[ link to this | view in chronology ]
Re: dumb ass says what.
[ link to this | view in chronology ]
Re: Re: dumb ass says what.
[ link to this | view in chronology ]
[this space intentionally left blank]
[ link to this | view in chronology ]
Re: [this space intentionally left blank]
I'd really like software that does this, but sends the images to me instead of a third party. That'd be cool.
[ link to this | view in chronology ]
Re: [this space intentionally left blank]
What an amazing idea for crime scene photo's, be they for private usage (ie: insurance claims) or criminal investigations (ie: Police, etc)
WANT!
[ link to this | view in chronology ]
Re: [this space intentionally left blank]
[ link to this | view in chronology ]
Re: [this space intentionally left blank]
Quick, someone port this over to voice activate.."Phone, where are my f-ing keys?"
*bzzzzz*
"Walk forward 3 paces, turn left, lift up the towel, there ya go!"
[ link to this | view in chronology ]
Re: Re: [this space intentionally left blank]
Phone - where's my pho... oh, wait. Dammit!
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re:
" It includes the following rather fanciful description of how this 3D-spying capability might be used. It's rather over the top, but it gives an idea of what's theoretically possible"
A scare piece, nothing more.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
I'd say the scare part is that it isn't the phone putting the pieces together, that's just an ordinary take data (photos), send them to IP type thing, and here's an extra thing that the server that receives them can do.
Even if it is the phone, big whoop, the server it sends them to could've done it a long time ago.
Either burglars are already using this, (in which case, provide evidence), or it's too troublesome, or this just gave some burglars a novel idea.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Only read to page 4
Told me all I needed to know.
[ link to this | view in chronology ]
Re: Only read to page 4
[ link to this | view in chronology ]
Re: Only read to page 4
There shall be no other OS but me.
[ link to this | view in chronology ]
Re: Re: Only read to page 4
[ link to this | view in chronology ]
Paranoia
[ link to this | view in chronology ]
Re: Paranoia
[ link to this | view in chronology ]
And what was that ?
I'm a little slow, so I don't get what you now 'know' from
the word 'Android'. Please, be so kind as to clue in the
those of us who are not quite as smart as you.
[ link to this | view in chronology ]
I learned from Android.
[ link to this | view in chronology ]
As malware, this IS truly creepy, but...
[ link to this | view in chronology ]
Re: As malware, this IS truly creepy, but...
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
Or - it is about religion.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Data fee
[ link to this | view in chronology ]
[ link to this | view in chronology ]
I do believe this sort of invasiveness will start to get annoying, questioned and ultimately addressed. Till then we take the needed steps to reduce it.
[ link to this | view in chronology ]
Curmudgeon FTW
[ link to this | view in chronology ]
Possible, but plausible?
Even if someone is using the phone as a phone (less likely nowadays as people tend to text more), they don't tend to wander around the house. In my experience, people park their butts on a chair so they can talk. Walking and talking usually occurs outside the house.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Didn't this already happen...
[ link to this | view in chronology ]