Screenshot-Reading Malware

Kaspersky is reporting on a new type of smartphone malware.

The malware in question uses optical character recognition (OCR) to review a device’s photo library, seeking screenshots of recovery phrases for crypto wallets. Based on their assessment, infected Google Play apps have been downloaded more than 242,000 times. Kaspersky says: “This is the first known case of an app infected with OCR spyware being found in Apple’s official app marketplace.”

That’s a tactic I have not heard of before.

Tags: Kaspersky, malware, smartphones, spyware

Posted on February 7, 2025 at 10:26 AM • 13 Comments

Comments

Clive Robinson • February 7, 2025 11:40 AM

@ Bruce,

With regards,

“That’s a tactic I have not heard of before.”

But I suspect neither a shock or even that unexpected.

Like the photographing of peoples keys to have the “pining pattern” for making a 3D print, it’s a logical progression of technological developments.

Actually thinking about it for a moment what, actually “surprises me” is why it’s taken so long to happen…

If you think back the first Home PC usable OCR goes back to the earliest days of “home scanners” back more than thirty years. Modern “Smart Devices” have thousands of times the capabilities in terms of CPU power and memory that even high end home PCs had thirty years ago.

So the obvious question would be,

“Why has it taken so long to happen?”

In some ways I would assume it’s not, but the need for it was so eclectic that there was no “mainstream need” amongst criminals of all varieties.

And for those that might such as “Security Services” would not go for “on device scanning” for two reasons,

1, Their victims were individually targeted and thus “Black-bagged”.
2, Their desire for secrecy would preclude the usage of such software to prevent it being found on a victims devices.

And for your more run of the mill criminal where the use of a “rubber hose” would look soft getting access to “in human memory” secrets would be given to some psycho or worse to do.

What has changed is the value of Crypto-Coins and the like, where knowing a “passphrase” anonymously enables a more sophisticated criminal time to not just take but launder / wash out the coins about as anonymously as they can.

Untill a year or so ago crypto-coins were of some value but not “go life in jail or the chair” value.

Now that is no longer the case, where even badly thought out petty almost “mugging” street level crime can get you hundreds of thousands if not millions of dollars faster than you could spend it.

Those with a little more thought can find “high value wallets” by looking on the blockchain. Many of those wallets would not have been set up in a way that would make the owner anonymous.

Which means that they and their mobile phones and similar Smart Devices are fairly easily traceable to slightly smarter criminals.

Getting access to those devices would almost be “trivial” as we know there are many companies in Israel / Italy and similar that specialise in “access for hire” to politicians and bureaucrats and two bit rent-a-cops all over the world.

So not only were all the pieces in place, a need to use them had surfaced, with in hindsight a not unexpected result.

Which leaves the obvious question for those with “valuable wallets” of,

“How do you protect not just the wallet and yourself, but all your devices as well?”

Whilst I can think of several ways, I’m just glad I don’t have,

1, A need to use them
2, Clean up an existing trail to me

But it does beg the further question of,

“Now it exists, what will it be repurposed for next?”

As some will know now E2EE is something Law Enforcement are going to have to give up on because the “Chinese have robbed us of NOBUS” they are going to want something else.

There are two options currently,

1, Device side scanning
2, Back up third party storage.

We know Apple looked at device side scanning for CSAM finding, and got struck down by “user push back” when it became clear that it could scan for anything.

But we now find out Apple are getting attacked by the UK government over third party storage,

https://www.bbc.com/news/articles/c20g288yldko

Put simply they demand access “anywhere in the world at any time” not only “no questions asked” but with significant penalties for not “jumping to it”.

AL • February 7, 2025 12:12 PM

My answer to these kinds of issues is to have a separate device that does the money and only the money, which is a tablet. There is no money on my phone or 2nd tablet. I think that reflects the state of the technology at this time.

SocraticGadfly • February 7, 2025 3:14 PM

Re AL (as I hope a comment of mine doesn’t sit in an eternal moderation queue) the real answer is not to use portable devices of any type for this. And, not to use a PC if you have a Mac.

Clive Robinson • February 7, 2025 5:28 PM

@ SocraticGadfly, AL, ALL,

With regards “using devices” and,

“The real answer…”

The honest answer is “don’t”

Or more correctly,

“Do not use any device that has known or unknown to you external communications”

Thus anything based on Apple or Google mobile device OS’s is a very definate “No No”. Likewise any OS from Microsoft that’s less than two decades old (though I normally say three decades).

Unlike most readers here I have the advantage of knowing how to design and build “Microcontroller devices” which do not have external communications except through “strongly mandated interfaces”. As well as having designed minimal OS’s for them (think BIOS++) that I can “re-grind” for most microcontrollers from 8bit upwards.

This gives me a level of “communications security” and other EmSec that few others here can get, unless they are prepared to put the work in.

The simple fact is you can get the source code and programming books for a number of OS’s for microcontrollers. You can if you hunt around get the likes of the original FIG-Forth source for the Z80, 6502, and 68000. You can also get a Forth based system that will run on PC’s as an intermediate “boot-loader” or OS in it’s own right. That back in the early days of PCI interface cards, enabled “one driver” for Intel, Sun and other RISC based CPU’s.

There are Open Source versions of DOS-lookalikes and K&R C-Compilers like Small C, and even a version of BBC Basic that was allegedly one of the best basics back in the 1980’s.

Interestingly for reasons I won’t go into you can get “Modern 6502’s” that people build Apple][ look alikes with. If you “build your own” or buy a kit, you can limit the external communications and with enough “box bashing” and some EMC skills stop TEMPEST and EmSec attacks both passive and active.

Likewise there are ZX80/81 and Spectrum kits out there and people build them for “the real retro gamer” feel.

With the source code and a little effort you would be surprised just what you could build.

But if you can do the EmSec stuff then there are plenty of “Open Source” “Single Board Computers”(SBCs) that are pocket change in price and have more computing power, memory and interfacing than most Mini-Computers up into the early 1990’s

As I’ve mentioned before MicroChip have a 1USD chip that someone ported an early version of BSD Unix onto which has all the ROM, RAM and IO you would need “on chip”. You can get a “dev kit” for pocket change and design your own PCB and get them etched for around 5USD.

Thus your level of security and technology is upto you if you put a little effort into it.

If you want to put less in then in the US go and find your local “rocket club” or many Maker clubs and a number of Amateur Radio Clubs that encourage electronic builders. You never know you might get a fun hobby or even a new job capability.

Though word of warning, I’ve turned way to many hobbies into professional career work, and the result is you loose another hobby and the fun that went with it. Which is why I do cooking, preserving and charcuterie as some of my hobbies these days (which is kind of “full circle” as I became a chef to pay my way through higher education as I had unfortunately become an “orphan”).

Uaf • February 8, 2025 12:27 AM

Store nothing security related in plaintext. Anywhere. Ever. Doing so asks for trouble. Even if prompts are stored in ‘plaintext’ other decryption challenges should remain. Defence in depth. I’m not in IT or security but I thought this was basic stuff.

CommenterGPT • February 8, 2025 2:44 PM

So, it’s not “malware” when it is a feature built into either the operating system or the application?

e.g.:

(1) https://support.microsoft.com/en-us/windows/detect-and-copy-text-from-your-photos-b0cd9659-beb2-419b-b662-0fec2e74c95d

(2) https://www.neowin.net/news/edge-to-get-advanced-screenshot-tools-with-copilot-ocr-and-more-here-is-how-to-try-them/

P.S.: please interpret my tone not as sarcasm but as an inexperienced end user asking a legitimate question. I truly do not fully understand how these technologies work in any true technical sense. I perceive an inconsistency here in that OCR is “malware” in one context and “a feature” in another, and I would appreciate some comment on this from those who know more than me.

Clive Robinson • February 8, 2025 3:49 PM

@ Uaf,

With regards,

“Store nothing security related in plaintext.”

I wish that was possible.

It’s not, if you want the information to be meaningful.

There are three basic things we can do with information,

1, Store it.
2, Communicate it.
3, Process it.

And there is a minimum of three types of information,

1, The actual data / message information.
2, Information about the data we oft call Meta-Data
3, Information about the meta-data you might hear talked about as meta-meta-data

The first two type of information as data can have the information fully encrypted, but the meta-data about it has to be mostly in plaintext if it’s to be stored, or communicated or processed by humans or a computer.

The third use of information as data for processing, can not currently be encrypted, and neither can the meta-data needed as part of that processing.

Meta-meta-data is hard for many people to get their head around and as such from an evesdropping perspective it usually matters not if it is encrypted or not (think of it as what would be used in “active forensics”, “traffic analysis”, and other forms of “resource-use” signals and metrics). That is because in most cases it’s not possible to protect the meta-meta-data by encryption etc only by reliable segregation. It’s a subject that needs way more open research.

If you want a more in-depth explanation drop a comment to that effect and I’ll give you more info.

Clive Robinson • February 8, 2025 5:07 PM

@ CommentorGPT,

With regards,

“I would appreciate some comment on this from those who know more than me.”

The answer to your question is,

“It’s not what the technology does it’s the perception of the use it is put to.”

It’s part of the “Observer Problem”.

The first thing to realise is even the AI of future fantasy that is currently being touted by the industry is not going to be “aware” in the way humans currently are in society.

Further that all technology is a “tool”, that is put to “use”, by a “Directing Mind” for a purpose / goal.

The actual notion of if that “use” is “good or bad” is decided by usually independent “observers” looking on in “judgment” oft well after the event.

What is “good or bad” is decided by an individuals perspective. In part by how it effects them, and in part by how it effects others. This perspective is based on their mores and morals and those of the social grouping they are part of.

It’s why I and others get up-tight about “think of the children” etc. It’s a way to manipulate society by pretending to be doing good whilst the actual intent is to do considerable harm to society.

Not long ago Apple introduced a form of “Device Side Scanning” supposedly to find CSAM. Sounds all very noble untill you realise that the mechanism will scan anything and everything on your personal device. Worse as part of that it will bypass any and all security measures on the device like encryption. Simply because it will be able to scan whilst it’s in the form that a “Human User” can use (ie plaintext).

Long before Apple got “shot down in flames” for even suggesting “Device Side Scanning” I had been cautioning that,

“No Secure Messenger APP, was secure.”

And that is as true today as it was when I said it. Today I look “prophetic” back then I was regarded as “paranoid” (not for the first time 😉 Funny how quickly things change when your advasary thinks “Might is right” and they “Must be the good guys” where as the exact opposite is actually true in both cases (as recent news about the UK Gov and Apple demonstrates).

The reason for my view point was and still is “simple engineering design”. That is on consumer and commercial devices the “communications end-point” is on the same device as the “encryption end-point” with no effective segregation, and that is very bad design just about all around, and not just from the privacy asspect.

Why bad? Well importantly the “system design” of such devices enables an “end run attack” from the “open communications” to the “private plaintext” space where the user has the “Human Computer Interface”(HCI / UI) where things are not protected by any privacy measures.

So as an attacker, why even try breaking the encryption, when you can just “put a shim in the drivers for the IO devices” where everything is unencrypted and in “plaintext” (something that has been done before with on device banking apps).

When you design a “secure system” the most important word is not “secure” but “system”.

Because the “system” like a chain is “only as strong as the weakest link”. It matters not a jot how strong individual links are. You need to either “design out” weak links or find a way to mitigate them (for various reasons I prefer “effective mitigation”).

Device side scanning which is rapidly going to become the next major “privacy battle” is put at the weakest link on any consumer or commercial device, and as such it effectively destroys that devices security thus user privacy.

The “mitigation” solution is to use “off device security” whereby you move the “security end-point” off the consumer / commercial device way beyond the “communications end-point” where no remote attacker can perform a “reach around” or “end-run” attack.

To see this consider you use “Perfect Secrecy” in the form of a “One Time Pad” and use pencil and paper, where you encipher and decipher in an entirely different room to your consumer / commercial device (how military ComCens were set up during WWII and later).

The privacy of the message depends on an attacker not being able to get at,

1, The Plaintext.
2, The OTP Key Material (KeyMat).

At either the 1st party or 2nd party in the communication end point locations (a little “field-craft” with flash paper an ash tray and a match tends to solve a lot).

Thus the problem has shifted from “securing the device” to “securing the KeyMat” (with securing privacy there is always “a problem” just like a bubble under wall paper when you hang it, the trick is knowing how to mitigate it).

But importantly, from the attackers perspective such as the UK-Gov, they can not just “hover it up” remotely at “near zero cost”. They will have to expend “considerable resources” and as part of the process make “considerable noise” neither of which they will wish to do because it will “Tip their hand” and in all probability alert the “target of interest”.

Anonymous • February 8, 2025 5:17 PM

I admit, for my least important accounts, sometimes I just screenshot the account creation screen with the password visible instead of putting it my password book.

ResearcherZero • February 11, 2025 12:47 AM

@Clive Robinson

Getting a meeting in-person to pass on or retrieve sensitive information from governments services and commercial service delivery is increasingly discouraged. Remote servicing and connected service delivery is now mandated for health care and all other crucial services.

Many users will not understand OCR or how to disable features like ReCall or CoPilot from being installed on new accounts. Scammers could easily exploit these technologies and trick the customer into installing malware on devices or providing access to their accounts.

Windows and Android do not target security as a market. Most users don’t treat devices as insecure and place all kinds of personal information on them. They transmit important information via insecure communications methods because their government departments, politicians, and service providers do not provide secure alternatives or mandate them.

It is a very good time for fraudsters. More than half of Australian businesses reported a cyber attack last year and the number of individuals being scammed continues to be high.

With few checks and balances, little oversight and very little consumer protection monitoring of large businesses, tech companies and lenders – the public are ripe for abuse.

I doubt they even teach signals cadets to build anything secure anymore, even radio. Do kids even know what a micro-controller is? Do they even etch boards at school these days?

ResearcherZero • February 11, 2025 1:09 AM

@Clive

You could sail up to our coastline and transmit a message by any means and the chance that anyone would notice or understand what was happening would be incredibly remote. All of the Cold War facilities have since been shuttered, so there is nowhere to even report anything.

I suppose you could call our domestic agency and they might have a web portal. The average buckaroo would have no clue and most of the investigators would be out of their depth. Not that anyone has been stealing our sensitive defense secrets. That wouldn’t happen here. 🙁

ResearcherZero • February 11, 2025 4:19 AM

@Clive Robinson

To get back to what you were saying, other nation states also have the resources. Due to their relationship with criminal groups, use of methods such watering-holes, supply chain attacks and the sharing of vulnerabilities is likely to provide many targets for criminal, espionage and state backed retribution. There is a growing body of evidence that such activities have increased, along with financial and logistical backing of the type that has been referred to as “AirTasker for Criminals”, in both the online and offline world.

Clive Robinson • February 12, 2025 5:41 AM

@ ResearcherZero,

With regards,

“You could sail up to our coastline and transmit a message by any means and the chance that anyone would notice or understand what was happening would be incredibly remote.”

That made me laugh in a sad way, because it’s a “half truth”.

Whilst it might be true for “your government” I suspect all those Chinese Fishing Vessels will not just “notice” but “understand” what is happening…

Screenshot-Reading Malware

Comments

Leave a comment Cancel reply