Soundcomber: A Stealthy and Context-Aware Sound Trojan for Smartphones.

TLDR

Smartphone malware that accesses on‑board sensors can illicitly collect private data, but existing sensory malware is neither stealthy nor efficient and can be blocked by simple permission restrictions. This work presents Soundcomber, a Trojan that uses only innocuous permissions to harvest targeted private information from the phone’s audio sensor, and also proposes a defensive architecture to counter it. Soundcomber employs context‑aware audio analysis with targeted profiles to pull out credit card and PIN numbers from tone‑ and speech‑based interactions, infers destination phone numbers from audio, and transmits the data via covert channels without direct network access. The Trojan achieves efficient, stealthy local extraction, dramatically reducing communication costs while evading existing security defenses.

Abstract

We explore the threat of smartphone malware with access to on-board sensors, which opens new avenues for illicit collection of private information. While existing work shows that such “sensory malware” can convey raw sensor data (e.g., video and audio) to a remote server, these approaches lack stealthiness, incur significant communication and computation overhead during data transmission and processing, and can easily be defeated by existing protections like denying installation of applications with access to both sensitive sensors and the network. We present Soundcomber, a Trojan with few and innocuous permissions, that can extract a small amount of targeted private information from the audio sensor of the phone. Using targeted profiles for context-aware analysis, Soundcomber intelligently “pulls out” sensitive data such as credit card and PIN numbers from both toneand speech-based interaction with phone menu systems. Soundcomber performs efficient, stealthy local extraction, thereby greatly reducing the communication cost for delivering stolen data. Soundcomber automatically infers the destination phone number by analyzing audio, circumvents known security defenses, and conveys information remotely without direct network access. We also design and implement a defensive architecture that foils Soundcomber, identify new covert channels specific to smartphones, and provide a video demonstration