Leveraging Social Engineering Techniques for Ethical Purposes: An Approach to Develop Fake Android App for Collecting Valuable Data Discreetly
DOI:
https://doi.org/10.31185/wjcms.268Abstract
Social engineering techniques are often viewed negatively due to their association with deceptive practices. However, these techniques can also be utilized ethically, as many cybersecurity professionals do, particularly when evaluating vulnerabilities and testing security defenses. This paper presents EDC (Ethical Data Collector), an Android application that utilizes social engineering techniques to discreetly collect valuable data from an Android device for ethical purposes. EDC employs deception through a simulated UI (fake) to engage the target for a period, while secretly collecting data such as device information, active phone number, and images in the background, then sending them to a designated server via the internet. The researcher argues that EDC could help identify inexperienced cybercriminals or extortionists without complex efforts or significant cost, provided that its capabilities are judiciously utilized and subject to proper controls and oversight. EDC's development methodology emphasizes understanding the target's personality, predilections, and preferences to tailor the app experience as required for attracting the target to install and run the application. The paper describes the core functions and workflows for collecting and sending data. Additionally, permissions handling has been addressed as being critical for enabling EDC to collect the required information. Testing on Android emulators demonstrated that the EDC's APK file size is 4 MB, and data collection and transmission processes functioned as intended across various Android versions. The minimum SDK version required to run EDC is level 16. The total estimated time to complete the fake UI process (cumulative user engagement time) is 57-60 seconds, where each activity takes 8 seconds based on the adopted development approach.
References
Z. Wang, H. Zhu, P. Li, and L. Sun, "Social Engineering in Cybersecurity: A Domain Ontology and Knowledge Graph Application Examples," Cybersecurity, vol. 4, no. 1, 2021, pp. 1-21. DOI: 10.1186/s42400-021-00094-6.
F. Mouton, M. M. Malan, L. Leenen and H. S. Venter, "Social Engineering Attack Framework," 2014 Information Security for South Africa, Johannesburg, South Africa, 2014, pp. 1-9. DOI: 10.1109/ISSA.2014.6950510.
F. Salahdine and N. Kaabouch, "Social engineering attacks: a survey," Future Internet, vol. 11, no. 4, pp. 1-10, 2019. DOI: 10.3390/fi11040089.
Ş. A. Duman, R. Hayran, and İ. Sogukpinar, "Impact Analysis and Performance Model of Social Engineering Techniques," 2023 11th International Symposium on Digital Forensics and Security (ISDFS), Chattanooga, TN, USA, 2023, pp. 1-6. DOI: 10.1109/ISDFS58141.2023.10131771.
R. Satrio Hadikusuma, L. Lukas, and E. Rizaludin, "Methods of Stealing Personal Data on Android Using a Remote Administration Tool with Social Engineering Techniques," Ultimatics: Jurnal Teknik Informatika, vol. 15, no. 1, pp. 44-49, June 2023. DOI: 10.31937/ti.v15i1.3122
E. Blancaflor, H. K. S. Billo, B. Y. P. Saunar, J. M. P. Dignadice, and P. T. Domondon, "Penetration Assessment and Ways to Combat Attack on Android Devices Through StormBreaker - A Social Engineering Tool," 2023 6th International Conference on Information and Computer Technologies (ICICT), Raleigh, NC, USA, 2023, pp. 220-225. DOI: 10.1109/ICICT58900.2023.00043.
J. Raymond and P. Selvaraj, "An Effective Approach to Explore Vulnerabilities in Android Application and Perform Social Engineering Attack," in Proceedings of International Conference on Deep Learning, Computing and Intelligence, G. Manogaran, A. Shanthini, and G. Vadivu, Eds., vol. 1396, Advances in Intelligent Systems and Computing, Singapore: Springer, 2022, pp. 349–360. DOI: 10.1007/978-981-16-5652-1_32.
Statcounter Global Stats, "Mobile Operating System Market Share Worldwide." Accessed: May 30, 2023. [Online]. Available: https://gs.statcounter.com/os-market-share/mobile/worldwide
E. Wihidayat, "Pengembangan aplikasi android menggunakan integrated development environment (ide) app inventor-2," Edutic - Scientific Journal of Informatics Education, vol. 4, no. 1, 2017. DOI: 10.21107/edutic.v4i1.3229.
B. P. D. Putranto, R. Saptoto, O. C. Jakaria and W. Andriyani, "A Comparative Study of Java and Kotlin for Android Mobile Application Development," 2020 3rd International Seminar on Research of Information Technology and Intelligent Systems (ISRITI), Yogyakarta, Indonesia, 2020, pp. 383-388, DOI: 10.1109/ISRITI51436.2020.9315483.
S. S. Kumbhar, Y. Lee and J. Yang, "Hybrid Encryption for Securing SharedPreferences of Android Applications," 2018 1st International Conference on Data Intelligence and Security (ICDIS), South Padre Island, TX, USA, 2018, pp. 246-249, DOI: 10.1109/ICDIS.2018.00047.
N. Bu, S. Niu, L. Yu, W. Ma, and G. Long, "Bridging semantic gap between app names: collective matrix factorization for similar mobile app recommendation," Web Information Systems Engineering – WISE 2016, pp. 324-339, 2016, DOI: 10.1007/978-3-319-48743-4_26
Y. Hu, H. Wang, L. Li, Y. Guo, G. Xu and R. He, "Want to Earn a Few Extra Bucks? A First Look at Money-Making Apps," 2019 IEEE 26th International Conference on Software Analysis, Evolution and Reengineering (SANER), Hangzhou, China, 2019, pp. 332-343, DOI: 10.1109/SANER.2019.8668035.
O. Hussein, "Detection of integrity attacks on permissions of Android-based mobile apps: Security evaluation on PayPal," International Journal of Computers and Information (IJCI), vol. 11, no. 2, pp. 25-43, 2024, DOI: 10.21608/ijci.2024.277929.1156
S. Li, W. Jiang, Y. Yao, and C. Xu, "Permission analysis based on android app store," Proc. SPIE, vol. 12718, International Conference on Cyber Security, Artificial Intelligence, and Digital Economy (CSAIDE 2023), 127180Z, 2023, DOI: 10.1117/12.2681726.
N. S. Awang Abu Bakar, "Users comprehension and behavior study on Android permissions," IJPCC, vol. 2, no. 2, pp. 1-15, Oct. 2016, DOI: 10.31436/IJPCC.V2I2.29.
N. S. A. A. Bakar and I. Mahmud, "Empirical Analysis of Android Apps Permissions," 2013 International Conference on Advanced Computer Science Applications and Technologies, Kuching, Malaysia, 2013, pp. 406-411, DOI: 10.1109/ACSAT.2013.86.
B. Bonné, S. T. Peddinti, I. Bilogrevic, and N. Taft, "Exploring decision making with Android’s runtime permission dialogs using in-context surveys," in Proc. 13th Symp. Usable Privacy and Security (SOUPS 2017), Santa Clara, CA, USA, Jul. 2017, pp. 195-210.
R. Baalous and R. Poet, "Factors Affecting Users' Disclosure Decisions in Android Runtime Permissions Model," 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), Guangzhou, China, 2020, pp. 1113-1118, DOI: 10.1109/TrustCom50675.2020.00147.
S. Wang, Y. Wang, X. Zhan, Y. Wang, Y. Liu, X. Luo, and S.-C. Cheung, "Aper: Evolution-aware runtime permission misuse detection for Android apps," Proc. 44th International Conference Software Engineering (ICSE '22), New York, NY, USA, 2022, pp. 125-137, DOI: 10.1145/3510003.3510074.
S. Bistarelli, M. Ceccarelli, C. Luchini, I. Mercanti, and F. Santini, "Design and Implementation of a Covert Channel based on HTTP Headers," IJCI. International Journal of Computers and Information, vol. 11, no. 2, pp. 25-43, Apr. 2024. DOI:10.2139/ssrn.4822138.
Downloads
Published
Issue
Section
License
Copyright (c) 2024 Hussein Abdulkhaleq Saleh alsharya
This work is licensed under a Creative Commons Attribution 4.0 International License.
