EvilZone

Hi guys,

I would like some of your input on this. I have recently had a client where their network was tight. Obviously there were still loopholes, but the security team really knew what they were doing. So i came up with an idea to approach the task from another angle. And this is through the mobile architecture.

Some background about the idea:

So basically the CEO of the client approved a more mobile environment for the company, and they do not bring in laptops to meetings anymore, and most of their tasks are going to be run from mobile apps now. What I want to do is prove to them that mobile devices can be compromised as well. Now, what I want to do is send out an email to the employees in the company (I have obtained a record of all the employees) and tell them that I am the lead developer on one of the apps that they will be using. They then need to log in to my malicous app with their email, which will be hard coded to reject the initial login and redirect them to a new screen which asks them to register. (the credentials are logged by now and I can use their email credentials to read emails).

After this, I want to be able to record, screen print and read messages sent via the users and have it stored on my external hosting server. The problem I am facing is, that due to me knowing when meetings will be scheduled  etc I want to record on specific times. The thing is I have developed apps before that record automatically and that is not really the concern. I want to send the device a command, which does not pop up on the victim device, and I want it to send me a reply to my device stating the command is being executed. Obviously I dont want the device to upload a full day worth of recordings, since this will eat up bandwidth and consume a lot of data, thus exposing the intent.

Now I have done some research about sending the device commands via SMS and reading these resources:
http://www.undernews.fr/wp-content/uploads/2011/05/Shmoocon2011_SmartphoneBotnets_GeorgiaW.pdf
http://www.dtic.mil/dtic/tr/fulltext/u2/a562722.pdf

The main problem I see with this is that the user will see that messages are being sent to his device, stating "recordforgiggles" of "screenshotbecausebitches" and he wont know the number and he might block my cell number.

Have any of you worked on a project such as this? If so any input would be appreciated. I don't want you to write any functions for the program, I am just looking for intellegent approaches to look into this from other angles.

thanks

Maybe _read_ the sticky for the Beginner's Corner first.  It is will give you a lot if insight on how these forums work and how to ask your question(s).

Maybe_Realize_that the OP isn't on the forum anymore, and maby, just maybe don't reply to threads that are dead-or answered. 

I used to use the Kaspersky solutions.

Pretty neat interface, KES database is pretty up to speed on the latest malware etc. I would go for that if I were you.

What are your goals?

Set goals for yourself i.e "I want to become a programmer..." or "I want to learn more about cyber security" with that in mind you can divide the large topics into smaller category's to determine what you are interested in and learn from there.

In my opinion, learn everything you find interesting. You should learn more to better yourself. And in essence create potential opportunity's for career growth.

https://evilzone.org/wiki//index.php/Main_Page
www.google.com


Fucking seriously?

Thanks for the helpful information, I'll definitely check out those website. I'll try to put  around 10 hours into Python the days I'm off. @insert-name-here, I'm a somewhat fast learner, it depends on how badly I want to learn it, and in this case, I want it bad.

I give you a week, maybe two. Depending on how fast you fail. Because saying you will devote 10 hours every time you are off is just not normal. You look like Kali is your idol, great.


Thank god your posts don't have that quote any more. Now I only need to see it once every time you spam shit.


Edit: fuck its in the post above mine. Could you remove that shit?

Nice share.


This would be a great exercise for shits and giggles...