RAZOR_TIGER__2014__fireeye-sidewinder-targeted-attack.pdf

FireEye's report describes the "Sidewinder" targeted attack: adversaries hijack ad-library traffic (via DNS/BGP/ARP/MITM) and exploit ad libraries' insecure behaviors (JBOH, DLOH, exposed JS interfaces) to locate high-value Android devices and remotely execute actions — including uploading files, taking photos, recording audio/video, sending SMS, making calls, and stealthily installing apps. The paper analyzes ~73,000 popular apps, shows broad exposure across millions of downloads, demonstrates a proof-of-concept attacker control panel, and recommends stronger HTTPS/SSL validation and tighter controls on ad-library permissions to mitigate large-scale targeted exfiltration and compromise.