Adversaries may attempt to get a listing of network connections to or from the compromised device they are currently accessing or from remote systems by querying for information over the network.
This is typically accomplished by utilizing device APIs to collect information about nearby networks, such as Wi-Fi, Bluetooth, and cellular tower connections. On Android, this can be done by querying the respective APIs:
WifiInfo for information about the current Wi-Fi connection, as well as nearby Wi-Fi networks. Querying the WiFiInfo API requires the application to hold the ACCESS_FINE_LOCATION permission.
BluetoothAdapter for information about Bluetooth devices, which also requires the application to hold several permissions granted by the user at runtime.
For Android versions prior to Q, applications can use the TelephonyManager.getNeighboringCellInfo() method. For Q and later, applications can use the TelephonyManager.getAllCellInfo() method. Both methods require the application hold the ACCESS_FINE_LOCATION permission.
| ID | Name | Description |
|---|---|---|
| C0033 | C0033 |
During C0033, PROMETHIUM used StrongPity to collect information regarding available Wi-Fi networks.[1] |
| S0405 | Exodus | |
| S0509 | FakeSpy | |
| S0408 | FlexiSpy |
FlexiSpy can collect a list of known Wi-Fi access points.[4] |
| S1185 | LightSpy |
LightSpy has collected a list of cellular networks and connected Wi-Fi history using a LAN scanner based on MMLanScan.[5][6][7][8][9] |
| S0407 | Monokle |
Monokle can retrieve nearby cell tower and Wi-Fi network information.[10] |
| S9040 | NGate |
NGate has requested for the |
| S0399 | Pallas |
Pallas gathers and exfiltrates data about nearby Wi-Fi access points.[12] |
| S0289 | Pegasus for iOS |
Pegasus for iOS monitors the connection state and tracks which types of networks the phone is connected to, potentially to determine the bandwidth and ability to send full data across the network.[13] |
| S0506 | ViperRAT |
ViperRAT can collect the device’s cell tower information.[14] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0636 | Detection of System Network Connections Discovery | AN1710 |
For Android, detect System Network Connections Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: WifiInfo.getBSSID()]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |