Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

Android Spyware Has Ties to Election Interference

Recently revealed surveillance-ware comes from a consultant with close ties to Russia's GRU who was sanctioned by the US for election-tampering.

A newly discovered Android malware strain has been tied to a US-sanctioned contractor with close connections with Russia's GRU.

According to researchers at Lookout, who found and dubbed the malware as Monokle, is able to steal personal information from an infected device and send it to any of a series of command-and-control (C2) servers. One of the unique aspects of Monokle is that it doesn't need root access to collect its information. Instead, it uses a series of existing techniques in novel ways to get a more complete picture of the user's data, interests, and on-line habits.

"The malware has a unique set of features. It can modify the Android device's trusted root certificate, capture the screen unlock sequence, and capture the auto-complete dictionary, among other things. It's very complete surveillance-ware," says Adam Bauer, senior staff security intelligence engineer at Lookout.

Monokle's source has been traced back to Special Technology Center (STC), a Russian defense contractor sanctioned for its role in interfering with the 2016 US presidential election. "The first reason Monokle is notable is because of its ties to a Russian government defense contractor who is also producing antivirus for Android," says Tim Erlin, vice president of product management and strategy at TripWire. "The second reason it's notable is because of the extent to which it's able to gather data and take advantage of of a mobile device."

According to the Lookout report, Monokle's ties to STC and the Android antivirus software are found in the code. "STC has been developing a set of Android security applications, including an antivirus solution, which share infrastructure with Monokle," the report states.

Lookout determined that Monokle is targeting very specific individuals because of the applications that carry the infection. Christoph Hebeisen, senior manager, security intelligence at Lookout, believes the surveillance-ware's qualities mean that it most likely will remain a tool for spying on high-value targets.

"Ultimately, we believe that this type of software is most likely to be used in targeted attacks, so whether you worry about it or not depends on your threat model," he says.

The Lookout researchers and Erlin point out, though, that there's nothing inherent in Monokle's technology that limits it to a particular target. "In this case, where we're talking about a tool that's been discovered in the wild and analyzed, the use of that tool that's been seen so far has been targeted," Erlin says. "But that doesn't mean that the tool itself couldn't be used in a variety of ways."

Bauer says that the Monokle code was first found in the wild in samples collected in 2016, but the code wasn't initially analyzed and found to be malicious until early 2018. Analysis has continued and more details have become clear. "We decided to go public now because of the relevance of this particular threat," Bauer says. "Once we found that the creator was STC, it became more relevant because the company has been sanctioned due to their connection to GRU in terms of election meddling."

Erlin says there are specific steps individuals and organizations can take to reduce their risk from the spyware: don't install apps from untrusted sources or from unknown third-party sources, and install mobile antivirus, he says.

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

 

 

 

 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
bwilkes8@gmail.com
100%
0%
[email protected],
User Rank: Moderator
7/26/2019 | 11:03:55 AM
RE: Android Spyware Has Ties to Election Interference
Good article, well balanced, however what if were mentioned that all users of the campaign party that were "hacked" opened spear phished and took the worm.  The penetration of their machines, the network and DNC was due to EMPLOYEES not adhering to basic security practices.  So there article might have included more insight, links and references to such tactics and how to detect them.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Cybersecurity Spending Hits 'Temporary Pause' Amid Pandemic
Kelly Jackson Higgins, Executive Editor at Dark Reading,  6/2/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13871
PUBLISHED: 2020-06-06
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
CVE-2020-13864
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.
CVE-2020-13865
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes.
CVE-2020-11696
PUBLISHED: 2020-06-05
In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4.
CVE-2020-11697
PUBLISHED: 2020-06-05
In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4.