0

I have a rooted android phone and I know there's a malware in the phone . The malware is capable of automatically connect to a nearby bluetooth device or wifi ap and stream whatever I do on the phone to the attacker .

My questions :

  1. What is the best way to dig out the malware ?

  2. Which part of android filesystem should I look into to dig out the malware ?

  3. What effective tool can I use to log the bluetooth and wifi connection if netstat and ifconfig can't detect the connection ?

someoneelse
  • 1
  • 2
    Can you describe how you know that there is malware on the phone and how you know it is capable of connecting to BT and streaming? Once we know what the malware is, then digging it out becomes easier – Unicorn Tears Aug 06 '19 at 20:48
  • 1
    If you don't know the answer to question 2, the answer to question 1 automatically becomes "Nuke it from orbit; it's the only way to be sure," and question 3 is moot. (Question 3 is off topic here anyways, as we don't do product/tool recommendations.) – Ghedipunk Aug 06 '19 at 21:26

1 Answers1

1

1) Unless you know very well what you're doing (for example experience with malware reverse engineering) or you know the exact malware used, I would advise against this. I would say it's better to just format the phone outright.

2) How do you know that there is malware on your phone? This would help track down where you might want to look.

3) This website talks about recording Bluetooth packets. This uses the phone's storage so it may be compromised by the malware, but I have personally not found malware that modifies these logs. According to http://www.fte.com/WebHelp/BPA600/Content/Documentation/WhitePapers/BPA600/Encryption/GettingAndroidLinkKey/RetrievingHCIlog.htm the way to get the logs of Bluetooth packets is as follows:

On the Android device go to Settings.
Select Developer options.
Click to enable Bluetooth HCI snoop logging. 
Return to the Settings screen and select Developer options.
In the Developer options screen select Enable Bluetooth HCI snoop log. The log file is now enabled.
On the Android device turn off Bluetooth.
Turn on Bluetooth.
Reboot the Android device.
The HCI log file is now being generated and is saved to /sdcard/btsnoop_hci.log.

As for recording communication over WiFi, I would recommend connecting to the AP and running WireShark on your computer to see what packets are flowing between your phone and the AP.

trallgorm
  • 885
  • 7
  • 19