Ever wonder what it would take to code up an Android based spyphone app? In this presentation from the BlackHat 2013 conference, Kevin McNamee outlines his build of an Android SpyPhone service that can be injected into any application. “The presentation includes a live demonstration of how phones can be tracked and operated from a Web based command and control server and a demonstration of how to inject the SpyPhone service into any Android application. The presentation will also cover the APIs used to track the phone’s location, intercept phone calls and SMS messages, extract e-mail and contact lists, and activate the camera and microphone without being detected.”
The PDF of the presentation slides is available for download.
Scary stuff!