1. Home
  2. Techniques
  3. Mobile
  4. System Network Configuration Discovery

System Network Configuration Discovery

On Android, details of onboard network interfaces are accessible to apps through the java.net.NetworkInterface class.[1] The Android TelephonyManager class can be used to gather related information such as the IMSI, IMEI, and phone number.[2]

On iOS, gathering network configuration information is not possible without root access.

ID: T1422
Sub-techniques:  No sub-techniques
Tactic Type: Post-Adversary Device Access
ⓘ
Tactic: Discovery
ⓘ
Platforms: Android, iOS
Version: 2.1
Created: 25 October 2017
Last Modified: 02 June 2020
Provided by LAYER 8

Procedure Examples

ID Name Description
S0310 ANDROIDOS_ANSERVER.A

ANDROIDOS_ANSERVER.A gathers the device IMEI and IMSI.[3]
S0540 Asacub

Asacub can collect various pieces of device network configuration information, such as mobile network operator.[4]
S0432 Bread

Bread collects the device’s IMEI, carrier, mobile country code, and mobile network code.[5]
S0529 CarbonSteal

CarbonSteal has collected device network information, including 16-bit GSM Cell Identity, 16-bit Location Area Code, Mobile Country Code (MCC), and Mobile Network Code (MNC). CarbonSteal has also called netcfg to get stats.[6]
S0425 Corona Updates

Corona Updates can collect device network configuration information, such as Wi-Fi SSID and IMSI.[7]
S0315 DualToy

DualToy collects the connected iOS device’s information including IMEI, IMSI, ICCID, serial number and phone number.[8]
S0478 EventBot

EventBot can gather device network information.[9]

S0522 Exobot

Exobot can obtain the device’s IMEI, phone number, and IP address.[10]

S0405 Exodus

Exodus One queries the device for its IMEI code and the phone number in order to validate the target of a new infection.[11]

S0509 FakeSpy

FakeSpy can collect device networking information, including phone number, IMEI, and IMSI.[12]
S0577 FrozenCell

FrozenCell has collected phone metadata such as cell location, mobile country code (MCC), and mobile network code (MNC).[13]
S0535 Golden Cup

Golden Cup can collect the device’s phone number and IMSI.[14]
S0536 GPlayed

GPlayed can collect the device’s IMEI, phone number, and country.[15]
S0406 Gustuff

Gustuff gathers the device IMEI to send to the command and control server.[16]
S0463 INSOMNIA

INSOMNIA can collect the device’s phone number, ICCID, IMEI, and the currently active network interface (Wi-Fi or cellular).[17]
S0407 Monokle

Monokle checks if the device is connected via Wi-Fi or mobile data.[18]
S0316 Pegasus for Android

Pegasus for Android checks if the device is on Wi-Fi, a cellular network, and is roaming.[19]
S0289 Pegasus for iOS

Pegasus for iOS monitors the connection state and tracks which types of networks the phone is connected to, potentially to determine the bandwidth and ability to send full data across the network.[20]
S0291 PJApps

PJApps has the capability to collect and leak the victim's phone number, mobile device unique identifier (IMEI).[21]
S0326 RedDrop

RedDrop collects and exfiltrates information including IMEI, IMSI, MNC, MCC, nearby Wi-Fi networks, and other device and SIM-related info.[22]
S0403 Riltok

Riltok can query the device's IMEI.[23]
S0411 Rotexy

Rotexy collects the device's IMEI and sends it to the command and control server.[24]
S0313 RuMMS

RuMMS gathers the device phone number and IMEI and transmits them to a command and control server.[25]
S0324 SpyDealer

SpyDealer harvests the device phone number, IMEI, and IMSI.[26]
S0328 Stealth Mango

Stealth Mango collects and uploads information about changes in SIM card or phone numbers on the device.[27]
S0329 Tangelo

Tangelo contains functionality to gather cellular IDs.[27]
S0545 TERRACOTTA

TERRACOTTA has collected the device’s phone number and can check if the active network connection is metered.[28]
S0427 TrickMo

TrickMo can collect device network configuration information such as IMSI, IMEI, and Wi-Fi connection state.[29]
S0506 ViperRAT

ViperRAT can collect network configuration data from the device, including phone number, SIM operator, and network operator.[30]
S0489 WolfRAT

WolfRAT sends the device’s IMEI with each exfiltration request.[31]
S0318 XLoader for Android

XLoader for Android collects the device’s IMSI and ICCID.[32]
S0490 XLoader for iOS

XLoader for iOS can obtain the device’s IMEM, ICCID, and MEID.[32]

Mitigations

ID Mitigation Description
M1005 Application Vetting

Application vetting could be used to analyze applications to determine whether they access this information, including determining whether the application requests the Android ACCESS_NETWORK_STATE permission (required in order to access NetworkInterface information) or the READ_PHONE_STATE permission (required in order to access TelephonyManager information).
M1006 Use Recent OS Version

Starting in Android 6.0, applications can no longer access MAC addresses of network interfaces.[33]

References

  1. Android. (n.d.). NetworkInterface. Retrieved December 21, 2016.
  2. Android. (n.d.). TelephonyManager. Retrieved December 21, 2016.
  3. Karl Dominguez. (2011, September 27). ANDROIDOS_ANSERVER.A. Retrieved November 30, 2018.
  4. T. Shishkova. (2018, August 28). The rise of mobile banker Asacub. Retrieved December 14, 2020.
  5. A. Guertin, V. Kotov, Android Security & Privacy Team. (2020, January 9). PHA Family Highlights: Bread (and Friends) . Retrieved April 27, 2020.
  6. A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.
  7. T. Bao, J. Lu. (2020, April 14). Coronavirus Update App Leads to Project Spy Android and iOS Spyware. Retrieved April 24, 2020.
  8. Claud Xiao. (2016, September 13). DualToy: New Windows Trojan Sideloads Risky Apps to Android and iOS Devices. Retrieved January 24, 2017.
  9. D. Frank, L. Rochberger, Y. Rimmer, A. Dahan. (2020, April 30). EventBot: A New Mobile Banking Trojan is Born. Retrieved June 26, 2020.
  10. Threat Fabric. (2017, February). Exobot - Android banking Trojan on the rise. Retrieved October 29, 2020.
  11. Security Without Borders. (2019, March 29). Exodus: New Android Spyware Made in Italy. Retrieved September 3, 2019.
  12. O. Almkias. (2020, July 1). FakeSpy Masquerades as Postal Service Apps Around the World. Retrieved September 15, 2020.
  13. Michael Flossman. (2017, October 5). FrozenCell: Multi-platform surveillance campaign against Palestinians. Retrieved November 11, 2020.
  14. R. Iarchy, E. Rynkowski. (2018, July 5). GoldenCup: New Cyber Threat Targeting World Cup Fans. Retrieved October 29, 2020.
  15. V. Ventura. (2018, October 11). GPlayed Trojan - .Net playing with Google Market . Retrieved November 24, 2020.
  16. Vitor Ventura. (2019, April 9). Gustuff banking botnet targets Australia . Retrieved September 3, 2019.
  17. I. Beer. (2019, August 29). Implant Teardown. Retrieved June 2, 2020.
  1. Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.
  2. Mike Murray. (2017, April 3). Pegasus for Android: the other side of the story emerges. Retrieved April 16, 2017.
  3. Lookout. (2016). Technical Analysis of Pegasus Spyware. Retrieved December 12, 2016.
  4. Lookout. (2016, May 25). 5 active mobile threats spoofing enterprise apps. Retrieved December 19, 2016.
  5. Nell Campbell. (2018, February 27). RedDrop: the blackmailing mobile malware family lurking in app stores. Retrieved September 18, 2018.
  6. Tatyana Shishkova. (2019, June 25). Riltok mobile Trojan: A banker with global reach. Retrieved August 7, 2019.
  7. T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.
  8. Wu Zhou, Deyu Hu, Jimmy Su, Yong Kang. (2016, April 26). RUMMS: THE LATEST FAMILY OF ANDROID MALWARE ATTACKING USERS IN RUSSIA VIA SMS PHISHING. Retrieved February 6, 2017.
  9. Wenjun Hu, Cong Zheng and Zhi Xu. (2017, July 6). SpyDealer: Android Trojan Spying on More Than 40 Apps. Retrieved September 18, 2018.
  10. Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018.
  11. Satori Threat Intelligence and Research Team. (2020, August). TERRACOTTA Android Malware: A Technical Study. Retrieved December 18, 2020.
  12. P. Asinovsky. (2020, March 24). TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany. Retrieved April 24, 2020.
  13. M. Flossman. (2017, February 16). ViperRAT: The mobile APT targeting the Israeli Defense Force that should be on your radar. Retrieved September 11, 2020.
  14. W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
  15. Hiroaki, H., Wu, L., Wu, L.. (2019, April 2). XLoader Disguises as Android Apps, Has FakeSpy Links. Retrieved July 20, 2020.
  16. Android. (n.d.). Android 6.0 Changes. Retrieved December 21, 2016.