Indiana students working with the US Navy have demonstrated malware capable of mapping a room and creating a 3D-navigable space to help information thieves find what they're looking for.
The Indiana University team, which includes a representative from the Naval Surface Warfare Center, created PlaceRaider – smartphone software which covertly takes snapshots every two seconds and then runs those snaps through existing analysis software to create a 3D model, which enabled users to find bank details, snatchable property and even when the residents were likely to be out.
The idea is that the software, called PlaceRaider, could be embedded into any of the camera-enhancement applications already available in the mobile app marketplaces, providing it with all the permissions it needs to carry out the attack. Once installed, PlaceRaider runs in the background, covertly taking snaps opportunistically as the user moves around the room with the phone. The malware mutes the volume before every snap to prevent the shutter sounding. Along with the pics, the camera records its orientation to help it build the 3D model later.
Obviously useless snaps are then discarded – which amounted to almost three-quarters of them in testing – and the rest are sent back to the miscreant along with the orientation data. All that data is then run through the Bundler toolkit - a stitching package following on from Microsoft's legendary Photosynth application, which glues together unrelated photos of the same subject. The result of that is run though the open-source Patch-based Multi-view Stereo Software to create a 3D navigable space.
It's not quite that easy, in the detailed write-up (PDF, detailed and well written) the team points out that Photosynth can rely on most pictures being horizontally aligned (as they come from Flickr, or are at least deliberately taken) while their samples were at all sorts of angles though they did have the orientation data to help address that.
The point of the process was to make it easier for the miscreant to find stuff worth seeing, so the team set a room with a decent amount of data on display (cheques on the desk, a wall calendar carefully noting foreign travel, and so forth). Twenty students were then asked to complete normal mobile-phone takes on an infected HTC Amaze, without knowing the true purpose.
Once the data had been gathered, another group of students were asked to see if the data contained anything useful, with half being given the raw images (between 800 and 1,400 of them per sample) and the other half getting the 3D experience. Unsurprisingly those able to visualise the space made a much better job of finding the data, showing the analysis was worthwhile.
That's nothing to panic about right now, the process was complicated and the threat indeterminate (take a look around you now, decide what in the vicinity would be of value to a thief, and realise the threat isn't really credible just yet), but that will change as the processing power of the phone increases (enabling it to filter out more information) and more bandwidth becomes available.
It was lack of bandwidth which prevented the team from using video, but the implications are obvious. Web cams have been hijacked many times, but they generally point in one direction and thus have limited value for snooping. A mobile-phone camera gets a decent sweep of the room every time a call is answered, increasing the risk hugely.
The PlaceRaider team recommend removing the ability to mute the shutter sound (which they do by reducing the volume, as Android already insists in playing it every time a photo is taken) and limiting access to orientation data, though they also admit that a PlaceRaider-detector would be trivial to write and that anti-malware software might become increasingly necessary as the cameras we carry around start being used against us. ®