There’s certainly no shortage of commercial spying apps for Android, with most positioned as parental control tools. In reality, however, these apps barely differ from spyware, with the exception perhaps of the installation method. There’s no need to even resort to Tor Browser or other darknet activity either – all you need to do is type something like “android spy app” into Google.
They are called ‘commercial’ because anyone can buy an app like this for just a few dollars.
Kaspersky Lab mobile products detect this sort of commercial Android spyware as not-a-virus:Monitor.AndroidOS.*. According to our telemetry, the popularity of these apps has been growing in recent years:
Unique users attacked by not-a-virus:Monitor.AndroidOS.*, 2016-2017
That’s why we decided to take a closer look at this controversial type of mobile software.
Features
Almost all commercial spyware apps are installed by manually accessing the target’s phone, and this is the only big difference between these apps and classic malicious spyware like DroidJack or Adwind. Customers have to download the app, install it and enter credentials that are received after purchasing. After that, the spying app becomes invisible on the phone. Installation usually only takes a couple of minutes.
Regular installation process (https://tispy.net/install-guide.html)
Some of these tools use device admin features to gain persistence and self-protection on the target’s phone.
So what does the customer get? Features may vary, but some of them are present in almost all these kinds of apps:
- Stealing SMSs
- Stealing calls (logs/recordings)
- GPS tracking
- Stealing browser data (history/bookmarks)
- Stealing stored photos/videos
- Stealing address books (with emails and even photos sometimes)
And if you’re still not impressed, then check out the actual feature lists (in addition to the above) of some popular commercial spyware for Android. We have added the infamous Pegasus APT and Droidjack spyware to our comparison table below to show the difference in features between them and monitoring apps. Pegasus is an advanced persistent threat, created by NSO Group. Droidjack is an RAT that was sold some time ago for a $210 lifetime license. This tool is more akin to TrojWare, because of features such as remote installation and customization of your own C&C server. However, even after several users in European countries were arrested, malware author Sanjeevi claimed that Droidjack is “very useful for users who use it legally”. He stated that “Droidjack is a parental tool for remote Android administration. It is strictly meant for that and no other reasons”. Anyone who breaks these rules, adds Sanjeevi, will have their license revoked.
| Stealing emails | Stealing surrounding voice | Stealing scheduled tasks/ calendar/ notes | Stealing social media/IM data | Backdoor behavior (e.g., remote control) | Photo/ video/ screenshot capture | Keylogging | Stealing clipboard | |
| Pegasus | + | + | + | + | + | + | + | – |
| DroidJack | – | + | – | + | + | + | – | – |
| TiSpy | + | + | + | + | – | + | + | + |
| Exaspy | + | + | + | + | + | + | – | – |
| iKeyMonitor | + | + | – | + | – | + | + | + |
| Mobistealth | + | + | + | + | – | + | + | – |
| mSpy | + | – | + | + | + | – | + | – |
| iSpyoo | + | + | + | + | + | – | – | – |
| SpyHuman | – | + | – | + | + | + | – | – |
| TheftSpy | – | + | – | + | + | + | – | – |
| TheTruthSpy | – | + | – | + | + | – | + | – |
| OneSpy | + | + | – | + | – | + | – | – |
| Highster Mobile | + | – | – | + | – | – | – | – |
| Spymaster Pro | – | – | – | + | – | + | – | – |
| DroidWatcher | – | – | – | + | – | + | – | – |
This comparison table shows that the difference between known sophisticated spyware and some commercial monitor apps is not that great and, in some cases, monitor applications can even grab more private user information.
Exaspy is an especially interesting case. This is a classic monitor application with a regular manual-access installation method (you have to enter license credentials after installation to start spying):
However, after news about a high-profile victim – a senior executive at a company – this monitor app is considered illegal for now. Note that there are a lot of similar apps that can result in cases like this.
Some special features (spying on social media apps, for example) only work on a rooted device, but the list is still impressive. The ‘Stealing social media/IM data’ feature is particularly important. It means that the spyware is able to attack other social media or messenger apps (depending on the specific product), for example, Facebook, Viber, Skype, WhatsApp, etc. As a result, an attacker can observe messenger conversations, feeds and other personal data from the victim’s social media profile.
These products use the same techniques as standard malicious spyware to steal data, and sometimes on a bigger scale. For example, here is a fragment of code from a commercial application called OneSpy with a list of external attacked applications:
As you can see, the commercial app is interested in all popular social media apps and messengers.
It’s ‘legal’
Above we mentioned that some commercial Android spyware apps like Exaspy were recognized as illegal after investigations. But many commercial spyware applications are still considered legitimate because, according to their sites, they were created “for everyone who needs a helping hand in protection of their loved-ones, their children, family and employees”.
Some of them claim that their products are ‘100% undetectable’. This may be true for the naked eye, but definitely not for our products.
But why do we think commercial spyware poses a danger and why do we detect it? There are several reasons:
-
- Almost all commercial spyware is distributed from its own site and landing pages. This results in vendors prompting users to enable the “Allow install of non-market applications” setting. This setting is very important for device safety because enabling it makes an Android device vulnerable to malware installation. For security reasons this method of distribution is contrary to Google policy.
Source: https://ispyoo.com/ispyoo-spy-android-installation-guide/
-
- Because some spying features only work on a rooted device, many vendors recommend rooting the targeted device. This opens the door for potential malware infection, and moreover, device rooting is contrary to Google policy.
Source: https://ikeymonitor.com/rooted-vs-non-rooted-features-for-android
- Not every vendor can guarantee the safety of personal data, and that applies not only to hacker attacks but also to simple methods of product security.
The last point is very important and our concerns aren’t baseless. I analyzed one commercial spyware app, investigating the vendor’s main site and C&C server. I soon found lots of files that had been uploaded to the server and that turned out to be users’ personal data collected by the app. Private files were stored on the server without any protection and could be accessed by anyone.
uh… security?
Many users of spyware apps who want to monitor the private lives of their relatives simply don’t understand that they may not be the only ones who will have access to such information.
To sum up, installing such apps, even on your child’s device, is a risky step that could lead to malware infection, data leaks or other unpleasant consequences. In our products we use a special technology for Android OS that helps detect dangerous apps capable of violating a customer’s data privacy. There is one simple and very important tip for everyone – always protect your phone with a password, PIN or fingerprint, so an attacker won’t be able to manually access your device.
Source:https://securelist.com/android-commercial-spyware/83098/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
