People will sell you almost anything for your mobile on eBay, headsets, cases, replacement power adapters. Recently while looking for a data cable for a phone I ran across mobile “spying” software for sale.
We’ve run across relatively expensive commercial mobile spyware before. This was being offered at a tenth of the price with a lot of similar features. The software claims to allow:
- call monitoring
- reading text messages
- copying phonebook entries
Other claims of compatibility with and control of a wide range of phones may just be hype on the part of the seller. Some of the sellers suggest that buyers install the software on phones and offer them as gifts or for sale to the unsuspecting. It’s interesting that dozens of sellers were offering nearly identical software. This is usually an indication that the item being auctioned comes from a common source. Buyers should be wary of such auctions.
eBay will take down auctions with objectionable or malicious content if requested. Some auctions may not actually break the rules or just come very close to the line.
Sellers will sometimes repackage publicly available information or open source software and set up an auction with terms like “Brand New” or “latest Pro version” in order to convince buyers that they’re getting a good value. There are also sellers offering CDs full of J2ME games. The prices for those collections imply that the included games are either freely available or pirated.
The cost of the software might be attractive, but none of the sellers offer any support. If it won’t run on your phone, there are no refunds. Even when the software is delivered on CD, no replacements are offered if its damaged in the mail. Occasionally pirated software is also sold in this manner. A number of the spying software auctions are actually selling links to download the software.
November 7th, 2007 at 7:04 am
Nice Post! It brings to mind a talk Corey Benninger recently gave at the NYNJMetro OWASP meeting about mobile phone security,
he was showing how this type of software is becoming more and more available. He specifically used FlexiSPY (http://www.flexispy.com/) as an example, pointing out the “Catch Cheating Spouses” marketing campaign that seems to be constant across these types of commercial spyware and that the interesting thing is that these types of software are getting valid certificates which is provided by the mobile phone OS vendor!