Android Device Hacking Tricks and

Countermeasures
Khulood Al Zaabi
College of Technological Innovation
Zayed University
Abu Dhabi, UAE
[email protected]

Abstract -- Cybercrimes have increased against Android targeted by criminal activities. The scope of this
devices due to the increased usage of Instant Messaging, paper is to concentrate on the Android hacking tricks
Global Positioning Systems (GPS) and Webcam and countermeasures. In other words, the research
Applications that are built into the Android device, paper focuses on how criminals utilize the Android’s
resulting in invasion of the victim’s privacy. The
existing studies demonstrate how to utilize the
built-in vulnerabilities, and showcases how they
vulnerabilities of the Android device; however, none overtake the victim’s phone by using diverse hacking
have proposed a comprehensive study highlighting the strategies in order to violate their victim’s personal
hacking tricks and their countermeasures. This study information. The remainder of this paper is organized
demonstrates how to discover and fully control the as follows: Section II presents the “Background and
Android device using existing tools. Furthermore, it Related Work” where I review the previous literature
proposes a novel GPS Tracking Application. The regarding hacking tricks for Android devices. In
purpose of this research is twofold: 1. To demonstrate
section III, I talk about the “Problem and
how to disclose the victim’s sensitive information after
performing diverse hacking tricks; and 2. To implement Motivation”. Section IV illustrates the “Proposed
countermeasures for each Android hacking tricks. The Approach” and the tools and techniques used. This is
author believe that such a scenario is needed for then followed by an overview of my “Experimental
implementing awareness among Android device users. Results” in section V, and the results are discussed in
Also, it shows Android and Instant Messaging the section titled “Experimental Discussion”. In
Application developers to mitigate existing section VII, I conclude my research and propose
vulnerabilities, thereby enhancing security levels. “Future Work”.
Keywords----Android Hacking; GPS Hacking; WhatsApp
II. BACKGROUND & RELATED WORK
Hacking; Android Hacking Tricks; Android Hacking
Tools; Countermeasures The domain of Android hacking is an ever-
evolving area at both the individual and business
I. INTRODUCTION level due to the unique characteristics, features, and
In the Post-PC era, the use of small, portable flexibilty of this device. In the following sections, the
tablets and Smartphones has skyrocketed. They have research paper will introduce: 1. The Android device
become the preferred choice for communication, platform; 2. An overview of the WhatsApp Instant
performing online banking transactions, taking and Messaging Application; and 3. The Global
uploading photos and videos, sending messages via Positioning System.
Instant Messaging Applications (i.e. WhatsApp), A. Android Device Platform
pinpointing locations using the Global Positioning
The Open Handset Alliance (OHA) developed an
System (GPS), and more. The number of Smartphone
open-market Operating System which strives to
users has reached around 7 billion worldwide.
“accelerate innovations in mobiles and offers
Currently, the Android Operating System has gained
consumers a richer, less expensive, and better mobile
significant popularity over the Apple device since
experience” [7]. Gartner Inc. stated that the Android
being released into the mobile industry in 2008 [1, 2,
device embraced 25.5% of the world’s Smartphone
3]. The Smartphone is popular due to significant
sales. According to the IDC Q2 2014 report [8], the
improvements in its functionality, and because it has
Android device occupied 85% of the market as seen
the capacity to store a considerable amount of the
in Fig. 1. However, sophisticated criminal offenders
user’s sensitive data [2, 4]. However, the Smartphone
have become familiar with the Android device’s
has also become more susceptible to cybercrimes that
built-in vulnerabilities and loopholes [1, 9].
violate the victim’s confidentiality, integrity, and
Cybercriminals have made millions of dollars by
availability [1, 5, 6]. As stated by the Norton Report
deceiving Android users by requesting them to
in 2013 [5], 38 percent of Smartphone users are being
download malicious third-party Applications [5]. The

978-1-5090-6096-2/16/$31.00 ©2016 IEEE

unverified Applications subsequently grant the C. Global Positioning System (GPS)
attacker full access to the victim’s sensitive data [5, The Global Positioning System was developed by
8]. the U.S Department of Defense (DoD) in 1995, using
24 satellites. This system is capable of operating with
civil, commercial, and military users around the
globe [16]. The Android GPS is part of the Google
Play Services, which tracks and pinpoints the exact
location of the users [17]. GPS users can utilize both
the built-in GPS and Network Location Provider
(NLP). The GPS is more accurate than the NLP;
however, it is only capable of being operated
outdoors. Moreover, the GPS takes a long time to
Fig. 1. Distribution of mobile operating system in Q2 2014, forward the requested location. On the other hand,
according to IDC. Source (media.kaspersky, 2014) the NLP consumes less battery power than the GPS
and can be operated indoors and outdoors. However,
B. Overview of WhatsApp Instant Messaging
identifying the user's location is complicated because
Application
the longitude and latitude becomes different every
In September 2015, the popularity of the time the user moves to a new place.
WhatsApp messaging application reached 900 This section presents a comprehensive review of
million users worldwide as shown in Fig. 2 [10, 11, the plethora of related research studies that cover
12, 13]. WhatsApp is a free proprietary cross- Android device hacking techniques. More
platform messaging application which is installed on specifically, it focuses on the hacking of Android
a client's Smartphone and is not operable without the Applications, Android Messaging Application such
Internet. The user can then subscribe to the as WhatsApp, Global Positioning Systems on
WhatsApp service to send text messages, share Android devices, describing the various types of
images, videos, locations and more with other attacks and the countermeasures. Whether or not the
WhatsApp users [10, 13, 14, 15]. In late January Application is running, Wu and Li [18] succeeded in
2015, Koum [10] announced on his Facebook page hacking the Android Application by proposing two
that: methods: static and dynamic methods. In the static
“Our web client is simply an extension of your method, they modified the Application’s dex and
phone: the web browser mirrors conversations and APK files, while in the dynamic method, they
messages from your mobile device—this means all of modified the execute byte code. Moreover, they
your messages still live on your phone” concluded their research by discussing how to detect
and protect the Android Application against these
Koum's announcement was about the release the types of attacks [18].
WhatsApp PC desktop version called “WhatsApp Abura’ed et al. [19] discussed three exploitable
Web” [10, 12, 13]. This version supports all desktop vulnerabilities: 1. Overriding the default behaviors of
browsers except for the Microsoft Internet Explorer buttons; 2. Access permissions, and 3. The lack of
and was activated to work with Google Android, identity indicators used to perform phishing attacks
Windows Phones, Nokia, iPhones, and BlackBerry using a Trojan. They succeeded in imposing a
devices [10, 12, 14]. Due to the increase in the significant threat without the victim’s knowledge,
numbers of WhatsApp Web users, now reaching 200 and without degrading the victim’s machine
million, cyber-attacks are also on the rise, thus performance. In addition, they recommended
compromising the personal data stored on the these enhancing the Android’s security against these types
devices [11, 12]. of attacks by monitoring the machine’s running
process, implementing the SSL certificate for each
trusted Application, and keeping the identity
indicator such as the watermark [19]. Erich and Cliff
[20] conducted a novel denial-of-convenience attack
against Android and iPhone devices for non-technical
users. The researchers exploited the Smartphone’s
connectivity management protocol by configuring a
fake Wi-Fi access point, and forcing their victims to
connect via the non-valid access point. This was done
with the purpose of disabling the Internet connection
availability of their victims. At the end of their
Fig. 2. Number of monthly active WhatsApp users worldwide (in
millions). Source (statista, 2015)
research, they proposed a novel Internet access
validation protocol as a defense against this type of Moreover, the researcher intended to gain full control
attack. The proposed solution used cellular networks of the victim’s Android device, such as overtaking
in order to send a secret key phrase to the Internet’s the Android’s Webcam, decrypting the WhatsApp
validation server [20]. Instant Messaging, and more. Furthermore, the author
Furthermore, Yubo et al. [21] presented their was able to discover all of the active devices which
research on how to deploy a malware against a were connected to the same attacker’s network using
Smartphone device such as the Android system. This the zANIT. Lastly, the researcher presented
was accomplished by manipulating the Short countermeasures for each trick in order for the
Message System (SMS) protocol and using the Short victims to become savvy in safeguarding themselves
Message Type (RS MT) as an attack vector. Next, and also, protecting their private information from
they attempted to forward this message to the being exposed to attackers.
victim’s device by using a Software Defined Radio
(SDR). The authors achieved their goal after proving III. PROBLEM AND MOTIVATION
that the device’s antivirus software was not able to As reported by the Google Investor website [9],
detect the injected attack [21]. Additionally, Nguyen over 350,000 devices are being activated daily as of
et al. [22] achieved their goal in stealthily discovering February 2011. This is because of the Android’s
the target’s location without the victim’s consent, by Smartphone features which enable communication
developing an unauthorized Location Inference between individuals and businesses with a high level
(UnLocIn) approach. This approach was possible of information management. However, the developer
with the insensitive Wi-Fi permission, as it bypassed of the Android device offers it in the open-market
the malware detection technique. The researchers model with limited controls. As a result, the Android
examined 51 free Apps on Google Play, and Operating System and its Applications have become
succeeded in inferring the target’s location with a 50- susceptible to critical security threats by sophisticated
meter accuracy range. This paper also discussed how criminals who spy on users and violate their privacy
to counter the proposed UnLocIn attack [22]. While via the Internet [1]. Kaspersky Lab’s security [8]
[23] described the most common social engineering illustrates various types of attack statistics against
attack techniques on knowledgeable workers, Android users in May 2012 (Fig. 3). Their study
Krombholz et al. presented comprehensive stated that the number of Android attacks and the
terminology that assisted them in classifying the targeted users grew dramatically during the period
social engineering attacks in terms of four between August 2013 and July 2014 [8].
parameters. These parameters include the attack
channel, the attack operator, various kinds of social
engineering and realistic attack scenarios. Moreover,
this research included the most advanced attack
vectors within the common communication channels
and computer-supported collaboration, such as
Mobile Messaging Applications (i.e. WhatsApp). In
addition, the researchers supported their research by
describing countermeasures against this type of
Fig. 3. Detections by Kaspersky Lab’s security of cyber-attacks on
attack [23]. In this paper, Krombholz et. al. Android. Source (media.kaspersky, 2014)
demonstrated the Cross-site scripting attack
(XSS)techniques used against the Android's The recently released WhatsApp Desktop version
WebView, whereas, Bhavani [24] utilized the Web not only attracts users, but also attracts
Application vulnerabilities to exploit the victim’s cybercriminals. It allows them to launch a series of
WebView, by launching a malicious code through the attacks such as spreading malicious messages for the
HttpClient APIs. The researcher concluded that this purpose of infecting the user's phone device and
type of attack can result in disclosing the victim’s invading their privacy for monetary benefits [25].
sensitive information (i.e. phone contacts), session This is one of the reasons why the authors employed
hijacking, and stealing the cashed cookies in order to hacking techniques against WhatsApp and the
impersonate the victim [24]. Android device’s GPS. According to Ralf-Philipp
This paper complements the existing research by Weimann, a researcher at the University of
conducting various types of hacking tricks against Luxembourg [26], the GPS is a critical Android
Android devices. However, the previous work did not device vulnerability. The issue begins when the
demonstrate a comprehensive hacking phase such as Android device asks the victim to pinpoint their
the one conducted in this research. The author of this approximate location on the cellular network. These
paper performed social engineering tricks to discover messages are then sent to an unsecured Internet link,
the victim’s current geolocation (GPS hacking). which encourages the attacker to trick the Android
device into exchanging the location message with
them, instead of the cellular network. As a result, the
attacker is able to track the victim’s location, and
also, to send a malicious code directly onto the
victim’s device processor. This is done with the
purpose of remotely controlling the victim’s
Smartphone [26]. The goal of the present research
was to identify these vulnerabilities, exploit them,
Fig. 4. Root Checker Basic Software
and implement countermeasures.

IV. PROPOSED APPROACH Then the attacker downloaded the zANTI.APK file
To conduct the experimental scenarios, the author from Zimperium Mobile Security, and installed it on
configured a Laptop with the required mobile their Android device, allowing her to discover all of
hacking tools, as well as two Samsung Galaxy S3 the connected devices such as Laptops and mobile
devices. The "Rooted" Android device acted as an devices. Fig. 5 illustrates the zANTIL software
attacker to exploit the victim’s device, while the other interface, including all of the active devices that were
one was used as the victim's device featuring various connected to the same network as the attacker. In
types of vulnerabilities for exploitation purposes. The this scenario, the attacker started probing this
devices were used for the purpose of performing Android device with an IP address of “192.168.x.x”
diverse types of Android hacking tricks by using and connected via “port 0”. All logs and Nmap scan
different tools and hacking techniques. By using the outputs were displayed for the targeted Android
Android Studio, NetBeans IDE, and PHP devices. The attacker could then perform advanced
respectively, the author proposed various types of scans against her target, by specifying the scan types
Android hacking tricks against the victim’s device. from the “Operative Actions” option, then connecting
GPS Tracking was the first trick used to identify the to the remote ports to exploit the open ports and
current victim’s geolocation. Moreover, all of the discovering vulnerabilities. This was conducted using
discovered live devices were connected to the same diverse types of attacks such as the Man-in-the-
network as the attacker using the zANTI Application, Middle attack. In addition, it could also check and
as well as the victim’s built-in Webcam, decrypting crack weak passwords, as well as verify the target’s
WhatsApp and the Kali Linux NetHuntertool (i.e. “ShellShock” and “SSL Poodle” vulnerabilities.
Metasploitable Framework). The author’s intention in Moreover, the attacker could perform “Smart
this research was to alert WhatsApp users, as the App Scanning” which enabled her to automatically check
plays a significant role in tracking their geolocation for vulnerabilities. In this scenario, the attacker
and disclosing their privacy, especially after the intended to perform an “Intense Scan”, which is also
author’s success in exploring WhatsApp known as an “Intrusive Scan” against the targeted
vulnerabilities when overtaking the Android device. device. This type of attack permits the attacker to
The main thrust of this research was threefold: 1. To detect versions and scripts of the Operating System.
discover the victim’s active device and its associated
features using the zANTI discovery tool; 2. To track
the victim’s geolocation, device ID, and Timestamp
using the GPS Tracking Application; and 3. To take
control of the victim’s Android device using Kali
Linux and its associated Applications (i.e.
Metasploit). In the following sections, the paper
presents the requirements and the installation
instructions for all of the hacking tricks conducted.
A. Network Map Discovery Fig. 5. zANTI Software Interface
The attacker browsed their Android device using
B. GPS Tracking
Starbucks' Wi-Fi public network for the purpose of
hunting their victim. The zANTI penetration testing In this section, the attacker intended to track her
tool assisted them in achieving their goal. Therefore, victim’s current geolocation with their permission, by
in order to install the zANTI, the attacker rooted her designing two different Applications. These are the
Android device by installing the “KingRoot” Android App “app-release.apk” (Android Application
software, Kingroot.apk file from Play Store. The Package File), using the Android Studio, and the
rooted device was verified by installing the “Root Desktop App “GPS_Tracker.jar", which is designed
Checker Basic” as illustrated in Fig. 4. using the NetBeans IDE. The Android App has three
classes: the GPS.java, the Launcher.java, and the
PostTask.java. The GPS.java is a type of Android
service and it implements the LocationListener which
is triggered when the GPS location is changed. In
addition, the “toString()” method is used to obtain the
location, based on the last updated time. Lastly, the
.java represents the launcher activity in the Android
java, and has a layout called “activity_launcher.xml”,
which consists of a label and a button. Therefore,
whenever the user clicks on the “Get GPS Position”
button, the launcher activity retrieves the current
geolocation from the GPS.java and displays it on that
label. Furthermore, the third class PostTask.java is
used to get the geolocation from the launcher.java,
and posts it onto the attacker’s Webserver. Fig. 6
illustrates the AndroidManifest.xml file.
Fig. 7. My GPS Finder App Permission

C. Overtake Android Device

In this study, the attacker intended to take control
of the victim’s Android device, in particular the
Android’s Webcam and decrypting the WhatsApp
Fig. 6. AndroidManifest.xml file using the Kali Linux NetHunter which was installed
on the attacker's Android device. The Metasploit
The second App, which is a desktop has one class Framework exists on the Kali Linux NetHunter,
“Launcher.java”, which is linked with two functions: which is a computer security project used for both
the clearTable() and the refreshTable(). The penetration testing and executing the exploit code
“ClearTable” function is used to connect to the server against the targeted machine. So, in order to install
and clears the database files which have old logs. The the Kali Linux NetHunter onto the Android device
“RefeshTable” function is used to connect to the (i.e. Samsung) in chroot mode, the malicious users
Webserver to search for and retrieve old records. need to install the following three Applications from
Moreover, this App has a JTable which encompasses the Android’s Play Store:
four columns: the Serial Number, the Device’s ID, • Busy Box: which provides the user with
the GPS’ location (latitude and longitude), and the several UNIX tools in a single executable file;
Timestamp (in GMT). Normally, for the purpose of • Linux Deploy: an open-sourced software used
Tracking Applications, the attacker creates two for easy installation of the Operating System
scripts and one text file to be available on her and GNU/Linux on the user’s Android device,
Webserver which are “gps.php”, “clear.php”, and and
“gps.txt” respectively. The gps.php script is used to • VNC Client, or VNC Viewer: is a remote
receive data from the Android App and these records access and control software which is
are saved onto the “GPS.txt” file, while, the compatible with Windows, Mac, UNIX and
“clear.php” script is used to delete all entries from the Linux machine agents, or a centralized server
gps.txt file located on the attacker’s Webserver. The is required.
malicious user performed social engineering The next step was to install these Applications
techniques to send the “app-release.apk” file onto her onto the attacker’s Android device. As mentioned
victim’s Android device. After downloading the earlier, the Busy Box should be installed first to grant
received .apk file and accepting the displayed the attacker a Root user. Moreover, the attacker
permissions, the victim installed the “My GPS should ensure that she has a good Internet connection
Finder” on their Android device’s App interface, as and she needs to keep the installation options as the
illustrated in Fig. 7. Later, and whenever the victim default. However, she should modify the distribution
used the “GPS_TRACKER APP” to check the GPS by choosing “Kali Linux”. Then, the installation
details, the App secretly sent details such as the process should run until it is completed in order to
Android device’s ID, the current geolocation move to the next step, which is clicking on the
(latitude and longitude), and Timestamp in GMT “Start” button to run the container. Now, the VNC
time-zone, and recorded them onto the Webserver of Viewer Applications will be used to connect to the
the hacker. Therefore, the victim’s sensitive container when entering these values such as
information was monitored and displayed onto the ADDRESS (i.e. localhost), NAME (i.e. Kali), and
attacker’s Desktop App which was linked with the PASSWORD. After setting these values, the
Webserver. “Connect” button should be pressed to display the
Kali Linux interface and therefore, start the Webcam Furthermore, the malicious user intended to disclose
snapping without the victim’s knowledge. The and decrypt the victim’s WhatsApp database by
attacker is now able to launch her attack by creating a employing the following files: the
backdoor (.apk), typing the attacker's IP address “msgstore.db.crypt8” and the key which is used to
(LHOST) and attacker’s port number (LPORT) decrypt the encrypted database using commands.
respectively; msfvenom –p Lastly, the researcher installed the “Windows
android/meterpreter/reverse_tcp; WhatsApp Viewer App” for the WhatsApp Database
LHOST=<xxx.xxx.xx.xx>LPORT<xxxx> R > decryption purposes. The first step was to insert the
/root/<filename.apk. Then, the Metasploit console “msgstore.db.crypt8” and the key files, generate the
will be loaded to install a listener by setting up a “msgstore.decrypted” file, and view this file as
reverse payload, and the listener begins by typing the illustrated in Fig. 9.
“Exploit” command as the following: msfconsole
use exploit/multi/handler
set payload android/meterpreter/reverse_tcp
setLHOSTxxx.xxx.xx.xx
setLPORTxxxx
exploit
After that, the attacker performed social
engineering against her victim with the purpose of
convincing them to download the fake.apk file by
enabling the “Unknown sources: Allow the
installation of non-Market Apps” option as shown in
Fig. 8.
Fig. 9. WhatsApp Viewer

V. EXPERIMENTAL RESULT
The author conducted various types of hacking
tricks against the victim’s Android device as was
mentioned in the previous section. The first hacking
trick was performed using scanning from Starbucks’
public network. This was done with the purpose of
discovering all active Android devices connected to
the same network of the attacker using the zANTI
penetration testing toolkit. Fig. 10 illustrates the
Nmap Scan Output of the zANTI. The victim’s
device (IP address) was detected, which
corresponded with all of the open/filtered and closed
Fig. 8. Download .apk File onto the Victim’s Android Device ports that were associated with its service for both
protocols, UDP and TCP. This output displays the
When the victim opened the fake.apk file and existence of the vulnerable ports which were utilized
downloaded it onto their device, the meterpreter to launch an attack against the targeted device.
prompt popped-up. The intention was to hack the Moreover, the attacker received the following
victim's Webcam, so that the attacker could take message after OS fingerprinting for the targeted
control of it by typing “webcam_list” to list all of the device: “Too many fingerprints match this host to
victim’s front and back Webcams. The next step was give specific OS details”. Furthermore, the zANTI
to take a photo without the victim's knowledge using network discovery tool obtained a lot of information:
the “webcam_snap” 1command. Moreover, the traceroute results such as the number of hops (1
attacker performed various activities when she HOP), Round Trip Time (RTT: 13.18ms), the
successfully took control of the victim’s Android targeted IP address (192.168.x.x), the number of
device. These include discovering the Android’s active hosts (1 host up), and all scanned ports were
system information, disclosing the victim’s contacts closed.
list, dumping the victim’s SMS messages, and For the second round of hacking tricks, the attacker
sending SMS messages from the attacker's device gained the current geolocation; latitude and
onto the one of the victim’s contacts list. longitude, the device’s ID, and the Timestamp values
by performing GPS Tracking. These values varied in
1
By default, the webcam_snap command was used to take a photo
accordance with the victim’s current geolocation, and
using the first (Back) camera changed from minute-to-minute whenever the victims
attempted to check their GPS using the customized
Application called “My GPS Finder”.

Fig. 12. GPS Tracker Interface App

The attacker succeeded in taking control of the

Android’s Webcam and taking a photo using the back
camera of their victim’s Android device without their
knowledge. They saved the Webcam shot on this
path: /root/JHOJRDTz.jpeg. Table 1 illustrates the
victim’s sensitive information which was found on
Fig. 10. Nmap Scan Output of the zANTI the Android device after taking control of it.
Fig. 11 illustrates the victim’s current geolocation Table 1. Outputs generated after Overtaking Victim’s Android
at Timestamp Thursday 10 10:30:51 GMT +05:30 Device
2016, with a latitude value of “24.7531393” and a Command Output
longitude value of “78.8387845” while using the sysinfo Computer : localhost
OS : Android 4.4.4 - Linux 3.4.0-2656
“My GPS Finder” App. armv7l)
Meterpreter : java/android
dump_contacts [*] Fetching 6 contacts into list
[*] Contacts list saved to:
contacts_dump_20160315121308.txt
dump_sms [*] Fetching 36 sms messages
[*] SMS messages saved to:
sms_dump_20160315121421.txt
webcam_snap - Webcam shot saved to:
12 /root/YPAxqHMj.jpeg
record_mic 5 Audio saved to: /root/EyYFewpa.wav
send_sms -d [+] SMS sent - Transmission successful
Fig. 11. Victim’s Current Geolocation at Timestamp Thursday 10 +97150xxxxxx
10:30:51 GMT +05:30 2016 x -t "Hi
Khulood."
Moreover, the attacker was able to monitor her
victim’s current geolocation as illustrated in Fig. 12. Furthermore, the decrypted WhatsApp database
The “GPS Tracker Interface” Desktop App, displayed was disclosed by the malicious user as shown in Fig.
four different latitude, longitude, device ID and 13. The WhatsApp Viewer App detected sensitive
Timestamp values for three different locations and information about one of the victim’s WhatsApp
Timestamps. Furthermore, the attacker continued her contact list. These include the phone number starting
malicious activities by taking control of the victim’s with the country code, last message Timestamp, and
Android device, more specifically, the Android’s a WhatsApp chat between the attacker’s victim and
Webcam and by decrypting the victim’s WhatsApp the victim’s WhatsApp contact list.
database.

Fig. 13. msgstore.decrypted.db (WhatsApp Viewer)

 VI. EXPERIMENTAL DISCUSSION to specify the current geolocation specifications.
The attacker succeeded in discovering all live Also, the Android Studio tool assists the malicious
devices with their open TCP or UDP ports associated user in creating fake .apk files to track her victims.
with the services running on the targeted device. The Therefore, users should be aware of this type of
scanning process is the second phase after hacking trick. However, the GPS has advantages,
reconnaissance, which involves discovering all of the despite its risks. From the perspective of forensic
target’s active IP addresses, open ports, and finding examiners, law enforcement agencies and parental
vulnerabilities related to the device’s OS, and more. supervision, a GPS is beneficial in many ways. It can
An attacker commented that the zANTI pen-testing assist them to detect crimes, reveal threats to the
tool was powerful while using it for Android hacking. parents’ children, or to monitor their children’s
However, the “Too many fingerprints match this host movement. It can also be used to protect children
to give specific OS details” message appeared while from pornography-related types of crime, by
performing an intense scan (advanced scan) against preventing their children from sharing their location
the target’s Android device. This message appeared to meet with others, for example.
when there were no open ports responding to the Taking control of the victim’s Android device
network traffic. As a result, the zANTI was not able played a significant role in this study. Using the
to perform an OS detection. Moreover, it relies on the Metasploit which is a pen-test tool used by both pen-
type of scan being used. In addition, the attacker tester and attacker simultaneously, the attacker was
came to realize that the scan type used during the able to fully control the victim’s device without their
experiment was not the best type if his intention was knowledge. This trick is dangerous, as the attacker is
to footprint the target device’s OS. However, the able to disclose the victim’s privacy such as dumping
current hacker was neither able to perform the Man- the contacts list, WhatsApp list and conversations in
in-the-Middle attack against her target’s device, nor plain-text, Webcam snap and more. Furthermore, this
to crack the victim’s Android device as they received tool can launch malicious codes which are generated
a message that “cracking 192.168.x.x service by the same tool (fake.apk file), to then overtake the
<Protocol> [http-get /], finished, no results”. In victim’s device, either by being connected on the
addition, the attacker discovered that the target’s same network (LAN), or a different network (WAN).
device was not vulnerable to the ShellShock and SSL In this study, the malicious user snapped the victim’s
Poodle vulnerabilities. photo and saved it onto her website to be utilized
Currently, GPS Tracking is considered to be one of later for black mail, which is also called extortion
the most crucial hacking tricks that threatens mail. This type of cybercrime has become
Smartphone users around the globe. As discovered in increasingly common nowadays. Table 1 illustrates
this study, it is capable of revealing the victim’s vital the researcher’s finding after controlling the Android
information such as the device's ID and geolocation. device and revealing crucial information about that
It can therefore assist the attacker to visit the victim’s device, such as the Operating System installed on the
geolocation and perform advanced hacking targeted device. By knowing the device’s OS, the
techniques such as social engineering, which can attacker can footprint the devices’ vulnerabilities by
result in stealing money from the attacker's victims. performing Search Engine techniques to seek updated
The paper’s author was able to track the current vulnerabilities and their patches. This is conducted in
geolocation of the targeted Android device, and order to attempt to design a sophisticated exploitation
disclose their device's ID for every Timestamp when against the vulnerabilities of the security controls,
the victims used the phishing GPS App. Besides that, and therefore, continue her hacking activities.
the malicious Android App developer achieved her Moreover, the device's OS assists the attacker in
goals by designing and linking the fake GPS App creating fake patches for these OS, and she then
onto her Webserver, and therefore, monitored and upload them onto the Android’s Play Store, which
displayed it onto her Desktop Interface as shown in results in a hacking activity. Furthermore, the paper’s
Fig. 12. This technique and the customized GPS App author succeeded in disclosing 6 of the victim’s
updates the attacker regarding her victim’s contacts lists and 36 of the victim’s SMS messages,
geolocation, records them onto the log files in and then saved them onto her website. In addition,
chronological order, and utilizes these records for the researcher was able to send SMS messages from
future cybercrime activities. Also, social engineering Metasploit onto the victim’s contact list. This
plays a main role in performing GPS hacking. hacking trick is widely used, not only to track more
Currently, an attacker can switch on/off the victim’s victims, but also to impersonate a victim. She commit
GPS or even the Internet using the .apk file which her crimes using the victim’s device, which is also
can be forwarded onto their victim via social called “Daisy Chaining”. This is done to hide her
engineering tricks. In the case of this research, GPS identity, and therefore counter law enforcement
Tracking was performed with the victim’s permission agencies by misleading and delaying their
investigation process. Furthermore, this trick is users should be wary of GPS Tracking by learning
currently appearing in cyberwar committed against about social engineering tricks that can prevent
countries in order to deceive their enemies after attackers from accessing their GPS Tracking.
taking over one of their soldier’s phone devices. This Moreover, zANTI may assist the security analyst in
trick is beneficial for law enforcement agencies, thwarting the malicious users, by identifying and
especially if they would like to discover the identity alerting them to the device's vulnerabilities, and also,
of the real criminal. Not only that, but WhatsApp is may simultaneously assist the hacker in exploiting
also considered a crucial cyber-attack platform at the the vulnerabilities of the victim’s device. The
present time to determine the victim’s location. In recommended future research is to conduct reverse
this study, the researcher was successful in dumping engineering to regenerate a new .APK file with a
and decrypting the victim’s WhatsApp database, legitimate interface, so that it can be then uploaded
including the victim’s contact list of phone numbers onto the App Store, to better analyze the
with country codes, the messages’ content, and the vulnerabilities of prospective victims worldwide.
last message Timestamp. The researcher Furthermore, it would be able to create an .apk file to
implemented the following countermeasures for each track the victim’s location. In other words, to switch
type of Android hacking tricks for the purpose of the GPS on whenever the attacker chooses.
mitigating or eliminating the risks generated from the Moreover, the paper’s author would like to conduct a
Android’s hacking tricks, and thereby safeguarding Stagefright attack code against vulnerable Android
the victims: device through text or MMS, for the purpose of trick
• Avoid social engineering, by not loaning or investigating other exploitable vulnerabilities with
borrowing other Android phones, as this can Android devices.
allow criminals to scan the WhatsApp QR code
REFERENCES
(WhatsApp Web);
[1] Gupta, A. (2014, March). Learning Pentesting for
• Avoid opening any suspicious links;
Android Devices (1st ed.).
• Use the relevant GPS radio jamming or phone [2] Packtpub. (2015). Practical Mobile Forensics.
frequencies to counter satellite Tracking devices; Retrieved March 06, 2016, from
• Avoid accepting any received .APK fake files; https://www.packtpub.com/packtlib/book/ApplicationDev
• Avoid sharing locations via WhatsApp; elopment/9781783288311/pref05
• Check the third party’s authenticity before [3] Casey, E., 2011, Digital evidence and computer crime:
downloading its Applications; Forensic science, computers, and the internet, Academic
press
• Protect the Android device from being tricked by [4] Bommisetty, S., Tamma, R., & Mahalik, H. (2014,
SMS Trojans by implementing controls; July). Practical Mobile Forensics (1st ed.). Birmingham,
• Pen-test the Android device using zANTI; UK: Packt Publishing.
• Be very cautious while browsing an Android [5] Ballano, M. (2014, August 11). Mobile Attacks:
rooted device as it will have Superuser Cybercriminals' New Cash Cow. Retrieved March 06,
privileges; 2016, from
http://www.symantec.com/connect/blogs/mobile-attacks-
• Avoid connecting the Android device to public
cybercriminals-new-cash-cow
Wi-Fi connections and, [6] Chell, D., Erasmus, T., Colley, S., & Whitehouse, O.
• Make sure to disable this option: “Install Apps (2015). The Mobile Application Hacker's Handbook.
from unknown sources” [7] Lessard, J., & Kessler, G. (2010, September). Android
Forensics: Simplifying Cell Phone Examinations. In Small
VII. CONCLUSION Scale Digital Device Forensics Journal, vol. 4, no. 1.
Overall, my research identifies the most critical [8] Kaspersky. (2014, October). Mobile Cyber Threats.
vulnerabilities within the Android device and/or with Retrieved March 06, 2016, from
its associated third party Applications such as http://media.kaspersky.com/pdf/Kaspersky-Lab-KSN-
WhatsApp and GPS, which are currently considered Report-mobile-cyberthreats-web.pdf
[9] Hoog, A. (2011). Android Forensics Investigation,
to be crucial cybercrime platforms within cyberwar. Analysis and Mobile Security for Google Android.
All users are advised to be wary while using their [10] Wikipedia. (2015). WhatsApp. Retrieved March 06,
Android device. They should co-operate with both 2016, from https://en.wikipedia.org/wiki/WhatsApp
Android device companies and third party [11] Buchanan, I. (2015, September 9). 200 million
Applications (i.e. WhatsApp) in identifying any Whatsapp users open to attack. Retrieved March 06, 2016,
noticeable and critical vulnerabilities. These should from http://geekpower.co.uk/2015/09/200-million-
then be reported in order to mitigate any loopholes whatsapp-users-open-to-attack/
before they are exploited by a potential attacker. [12] Global Positioning System. (2007, January 11).
Countermeasures against GPS trackers. Retrieved March
Furthermore, the Android device developer must 06, 2016, from
enhance the device's security levels to protect their
customers and avoid losing their trust. Also, Android
https://globalpositioningsystem.wordpress.com/2007/06/1 Networking Conference (CCNC), 2013 on (pp. 164-
1/countermeasures-against-gps-trackers/ 170). IEEE.
[13] Statista. (2015). Number of monthly active [21] Yubo, S., Zhiwei, Z., & Yunfeng, X. (2014,
WhatsApp users worldwide from April 2013 to September November). Using Short Message Service (SMS) to deploy
2015 (in millions). Retrieved March 06, 2016, from Android exploits. In Cyberspace Technology (CCT 2014),
http://www.statista.com/statistics/260819/number-of- International Conference on (pp. 1-5). IEEE.
monthly-active-whatsapp-users/ [22] Nguyen, L., Tian, Y., Cho, S., Kwak, W., Parab, S.,
[14] TechAdvisor. (2011, September 12). WhatsApp Kim, Y., Tague, P., & Zhang, J. (2013, June). UnLocIn:
Android app review. Retrieved March 06, 2016, from Unauthorized location inference on smartphones without
http://www.pcadvisor.co.uk/review/android-tablet- being caught. Privacy and Security in Mobile Systems
apps/whatsapp-android-app-review-3302802/ (PRISMS), 2013 International Conference on (pp. 1-8).
[15] The FORGE. (2015). Whatsapp: Overview. IEEE.
Retrieved March 06, 2016, from [23] Krombholz, K., Hobel, H., Huber, M., & Weippl, E.
https://theforgecoc.wordpress.com/whatsapp-overview/ (2013). Social Engineering Attacks on the Knowledge
[16] Wikipedia. (2015). Global Positioning System. Worker. In Proceedings of the 6th International Conference
Retrieved March 06, 2016, from on Security of Information and Networks, 2013 on (pp. 28-
https://en.wikipedia.org/wiki/Global_Positioning_System 35). ACM.
[17] Developers. (2015). Location Strategies. [24] Bhavani, A B. (2013, April). Cross-site Scripting
Retrieved March 06, 2016, from Attacks on Android WebView. International Journal of
http://developer.android.com/guide/topics/location/strategi Computer Science and Network (IJCSN), Vol. 2, Issue 2,
es.html April 2013, ISSN: 2277-542
[18] Wu, X., & Li, X. (2013, October). Hack android [25] Assolini, F. (2015, February 2). WhatsApp for Web
application and defense. In Computer Science and in the sight of cybercriminals. Retrieved March 06, 2016,
Network Technology (ICCSNT), 2013 3rd International from https://securelist.com/blog/research/68631/whatsapp-
Conference on (pp. 676-680). IEEE. for-web-in-the-sight-of-cybercriminals/
[19] Abura’ed, N., Otrok, H., Mizouni, R., & Bentahar, J. [26] Andrici, M. (2012, July 31). A-GPS vulnerability
(2014, November). Mobile Phishing Attack for Android could let hackers track your location, take over your
Platform. In Innovations in Information Technology phone. Retrieved March 06, 2016, from
(INNOVATIONS), 2014 10th International Conference on http://www.androidauthority.com/a-gps-vulnerability-
(pp. 18-23). IEEE. could-let-hackers-track-your-location-take-over-your-
[20] Zou, C., & Dondyk, E. (2013, January). Denial of phone-104532/
convenience attack to smartphones using a fake Wi-Fi
access point. In Consumer Communications and