System Network Connections Discovery

Adversaries may attempt to get a listing of network connections to or from the compromised device they are currently accessing or from remote systems by querying for information over the network.

This is typically accomplished by utilizing device APIs to collect information about nearby networks, such as Wi-Fi, Bluetooth, and cellular tower connections. On Android, this can be done by querying the respective APIs:

  • WifiInfo for information about the current Wi-Fi connection, as well as nearby Wi-Fi networks. Querying the WiFiInfo API requires the application to hold the ACCESS_FINE_LOCATION permission.

  • BluetoothAdapter for information about Bluetooth devices, which also requires the application to hold several permissions granted by the user at runtime.

  • For Android versions prior to Q, applications can use the TelephonyManager.getNeighboringCellInfo() method. For Q and later, applications can use the TelephonyManager.getAllCellInfo() method. Both methods require the application hold the ACCESS_FINE_LOCATION permission.

ID: T1421
Sub-techniques:  No sub-techniques
Tactic Type: Post-Adversary Device Access
Tactic: Discovery
Platforms: Android
Version: 2.1
Created: 25 October 2017
Last Modified: 31 March 2022

Procedure Examples

ID Name Description
C0033 C0033

During C0033, PROMETHIUM used StrongPity to collect information regarding available Wi-Fi networks.[1]

S0405 Exodus

Exodus Two collects a list of nearby base stations.[2]

S0509 FakeSpy

FakeSpy can collect the device’s network information.[3]

S0408 FlexiSpy

FlexiSpy can collect a list of known Wi-Fi access points.[4]

S0407 Monokle

Monokle can retrieve nearby cell tower and Wi-Fi network information.[5]

S0399 Pallas

Pallas gathers and exfiltrates data about nearby Wi-Fi access points.[6]

S0289 Pegasus for iOS

Pegasus for iOS monitors the connection state and tracks which types of networks the phone is connected to, potentially to determine the bandwidth and ability to send full data across the network.[7]

S0506 ViperRAT

ViperRAT can collect the device’s cell tower information.[8]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

System Network Connections Discovery can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.

References