Android Trojan records phone calls

A new Android Trojan is capable of recording phone conversations, according to a CA security researcher.

While a previous Trojan found by CA logged the details of incoming and outgoing phone calls and the call duration, the malware identified this week records the actual phone conversations in AMR format and stores the recordings on the device’s SD card, the company said.

The malware also “drops a ‘configuration’ file that contains key information about the remote server and the parameters,” CA security researcher Dinesh Venkatesan suggested that the recorded calls can be uploaded to a server maintained by an attacker.

According to Venkatesan, he tested the Trojan in a controlled environment with two mobile emulators running along with simulated Internet services, and posted screenshots with the results. “It appears the Trojan can only be installed if the Android device owner clicks the “install” button on a message that looks strikingly similar to the installation screens of legitimate applications,” he explained.

“After the malware and the remote server configuration file are installed on the Android device, making a phone call “triggers the payload” — in other words, recording the call and storing it on the SD card,” he added.

“As it is already widely acknowledged that this year is the year of mobile malware, we advice the smartphone users to be more logical and exercise the basic security principles while surfing and installing any applications,” Venkatesan said.

While Android provides more flexibility than the iPhone by allowing installation of third-party applications, even those that were not approved for the Android Market, this freedom seems to come with increased security risk. Malware-infected applications have also been found in the Android Market itself, but users can protect themselves by installing antivirus software, just as they would on a PC.