Mobile Malware · Cutting Off Malware · Lesson 5 of 5

Challenge: The Clockwork Phone

Help a company security team investigate a work phone that checks in every minute.

The overnight pattern

Dana works on the security team at a logistics company with 3,000 managed phones. The company's DNS filter and firewall logs feed a monitoring tool, and on Monday morning it flags one sales manager's Android phone.

The logs show three things since Thursday:

• Every 60 seconds, day and night, a small HTTPS connection to upd-sync-cloud.example. No other phone in the company has ever contacted it.
• A public registration lookup shows the domain was created five days ago.
• Every few hours, bursts of lookups for random-looking names like qzkvtrpw.example, nearly all of them failing.

The traffic is encrypted, so Dana can't read what's inside. The sales manager says the only new thing on the phone is a free PDF app installed from a link a customer sent.

Cutting it off

Dana's manager wants the connections stopped today without disrupting the other 2,999 phones. Dana can change the company's filtering DNS resolver, the secure web gateway and the firewall egress rules. The firewall log also shows which IP addresses upd-sync-cloud.example resolved to. Whatever is calling out, Dana wants the block to hold even if the app stops using the company resolver and connects to an address directly.

A changed answer

On Wednesday, a security vendor publishes a report naming upd-sync-cloud.example as part of a known banking malware campaign. The next day the domain starts resolving to an address the report says belongs to a research server that records incoming connections and sends nothing back. The sales manager's phone, now blocked by the company, still tries to reach it every 60 seconds.

Closing the case

The phone is now cut off twice over: blocked by the company, and its destination sinkholed. Dana's manager asks whether they can close the case and move on. Dana remembers the sales manager uses the phone for company email and the banking app for business expenses. Two other phones in the sales team also installed apps from links sent by the same customer last week, though the monitoring tool hasn't flagged them yet.