Android Botnet for SMS

Another area where SMS text messages may not have received as much scrutiny is regarding messages sent by mobile botnets. If I may I will re-emphasise the following point, the purpose of the discussions here and below are not as a criticism about tools or processes that are used in extracting, harvesting and/or treating recovered data but that data analysis is still required and cannot be rushed. If the examiner doesn't perform the analysis task does the officer or investigator (who may have considerably less experience) left to perform that role?

To avoid confusion a starting point about reference to botnets is required. One contribution is this intro into botnets: https://www.usenix.org/legacy/event/leet11/tech/slides/xiang.pdf 

The video below shows how one hacker, Georgia Weidman (2011), developed an Android Smartphone Botnet to send SMS text messages.




A brief description of the code (botPoCrelease-android.c) that use the smartphone to spawn messages using a Master/Slave/Target combination to hide the identity of the Master to the Slave.

==============================================================
Compile with arm-gcc with the -static flag set
Copy to anywhere on the underlying OS that is writable (/data/ is good).
Rename /dev/smd0/ to /dev/smd0real/
Start the bot application
Kill the radio application (ps | grep rild)
The radio will automatically respawn and now the bot proxy will be working
==============================================================

The original botnet code has been in the hacking community since 2011 but currently the code is hard to find. There is a sanitised version available though.

This proof of concept mobile botnet to generate SMS text messages still relies upon knowing the target's mobile number. The analysis thus focussing on the sending party (Master) knowing the recipient mobile number (Target) to hand to the donor (Slave). In the alternative, harvested mobile numbers returned from ICMP (or similar) pings via the internet could generate a high harvest of returned MSISDNs without the Target knowing his/her MSISDN has been acquired to send messages(SMS spam, etc.).

Threats and Forcing SMS delay

Following my article France Car Shootings and Mobile Evidence http://www.trewmte.blogspot.co.uk/2012/09/france-car-shootings-and-mobile-evidence.html an investigator, previously working with a well-known cellular and fixed network manufacturer, confirmed to me the results of an internal forensics investigation which he conducted.


An employee had made threats to a Director. The employee had been found to use a 'prepaid sim' card to send theat messages but added a delay period for the sent messages of 2-hours. The employee then switched OFF the handset and inserted the company SIM card into the same handset which had previously held the prepaid SIM that had sent the threat messages. The handset with the company SIM card in it was then switched ON; the employee claimed not to have been responsible for the threats sent from a different IMSI (SIM card).  The intention of the employee was to mask any connection with the threats. However, tracing the IMSIs of the prepaid SIM card and the company SIM card found both to have been operating in the same handset (IMEI). Such trace capability can be made from enquiries of network databases such as BTS, HLR etc. Moreover with high levels of text messaging that are sent and received whilst roaming there is trace capability that can be made by interrogating CAMEL.

There is also useful data that can be obtained for linking with cell site analysis (CSA), which is a bonus although there appears to be some confusion occuring in the US at the moment as to the value of CSA evidence http://www.forensicfocus.com/Forums/viewtopic/t=9679/ and how the material may be applied on a case by case basis. I am not convinced that licenced operators with highly developed as they are in the US cellular networks simply could not/would not sufficient call record/cell data available to know what is happening when an MS has been active in their networks, about the arrangement at a particular mast (cell tower) as used by an MS, the configuration of the radio network operating at the time an MS has been used and so on.

Evidence interpretation

Evidence interpretation

"The problem with SMS messages today is that one cannot tell which texts are truthful." 
William Ewart Gladstone (1809-1898)

20th Anniversary 2012/13 for SMS Texting

20th Anniversary 2012/13 for SMS Texting

If you like obscure facts, then this may be just up your street. Importantly, text messaging is one the of those services originally developed for GSM that has remained largely unchanged. Nokia have set out ten facts at the link below that they have gathered together about text messaging.  For instance, as Nokia records:

TEN. Texting is the leading cause of tenosynovitis, which is an inflammation in the thumb caused by constant text-messaging. (It’s like tennis elbow but smaller and less sporty.)

See more details at the link below:

http://nokiaconnects.com/2012/02/22/thanx-v-much-celebrating-20-years-of-the-humble-text-message/

Previously at my blog, I unearthed and presented details of a development by Sir Charles Wheatstone (1802-1875) of texting in the Victorian era called the Wheatstone ABC Telegraph, which can be found here:

http://trewmte.blogspot.com/2010/01/victorian-texting.html

Some other useful facts helpful to investigation for mobile telephone evidence.

DID YOU KNOW?

For mobile circuit switched SMS messaging as an investigator reviewing the various typical transfer Cases (A-F) to see which applies to the evidence is important. Considering transfer conditions are also undertaken for GPRS and WCDMA.

Case A: Mobile originating short message transfer, no parallel call.

Case B: Mobile terminating short message transfer, no parallel call.

Case C: Mobile originating short message transfer, parallel call.

Case D: Mobile terminating short message transfer, parallel call.

Case E: Mobile terminating short message transfer together with Inter‑MSC hand over, parallel call.

Case F: Mobile terminating short message transfer on SDCCH channel together with Inter‑MSC hand over.

However transfer cases are only one aspect, and when dealing with text messages understanding relevant instructions regarding the storage desitnation for a text messages are defined by Classes (0-3) :

Bit 1       Bit 0       Message Class
0              0              Class 0
0              1              Class 1   Default meaning: ME-specific.
1              0              Class 2   (U)SIM specific message
1              1              Class 3   Default meaning: TE specific.

SMS text message investigation doesn't end there as there are other aspects to consider such as the coding schemes used for the text messages, which can influence the maximum length of text messages, thus the user data length of a message. Commonly, the following coding schemes referred to are:

7-bit data - default GSM 160 characters (maximum 140 Octets)

8-bit data - user defined data (maximum 140 Octets)

16-bit data - user data up to 70 UCS2 characters (maximum 140 Octets)

But data coding scheme investigation doesn't stop because there are other aspects to messaging such as Cell Broadcast where 7-bit data coding allows for up to 93 characters, 8-bits data user defined is upto 82 Octets, but only 41 characters where UCS2 is used, are relevant. USSD messages using 7-bit data coding can be up to 182 characters.  In some instances, handsets sending MMS messages may only allow up to 120 characters to be attached with an image/photo.

There are of course a number of other technical aspects to consider, and not everything has been discussed above. Where training investigators or dealing with evidence, I always make the caveat that it may be easy to accept text messages on face value once the text message message has been recovered from logical storage or free space (deleted), however analysis of the TP-UD header is extremely important task to perform.