MITRE ATT&CKtechnique

T1429 Audio Capture

Published 2017-10-25 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Collection
Platforms
Android, iOS
Version
3.1
Created
2017-10-25

Description

Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device. Examples of audio information adversaries may target include user conversations, surroundings, phone calls, or other sensitive information. Android and iOS, by default, require that applications request device microphone access from the user. On Android devices, applications must hold the `RECORD_AUDIO` permission to access the microphone or the `CAPTURE_AUDIO_OUTPUT` permission to access audio output. Because Android does not allow third-party applications to hold the `CAPTURE_AUDIO_OUTPUT` permission by default, only privileged applications, such as those distributed by Google or the device vendor, can access audio output. However, adversaries may be able to gain this access after successfully elevating their privileges. With the `CAPTURE_AUDIO_OUTPUT` permission, adversaries may pass the `MediaRecorder.AudioSource.VOICE_CALL` constant to `MediaRecorder.setAudioOutput`, allowing capture of both voice call uplink and downlink. On iOS devices, applications must include the `NSMicrophoneUsageDescription` key in their `Info.plist` file to access the microphone.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1011 User Guidance mitigation
  • M1006 Use Recent OS Version mitigation

Referenced by MITRE ATT&CK · uses (54)

  • S9006 VajraSpy software (malware)
  • S9005 DocSwap software (malware)
  • S1243 DCHSpy software (malware)
  • S1241 RatMilad software (malware)
  • S1231 GodFather software (malware)
  • C0054 Operation Triangulation campaign
  • S1185 LightSpy software (malware)
  • S1128 HilalRAT software (malware)
  • C0033 C0033 campaign
  • S1126 Phenakite software (malware)
  • S1195 SpyC23 software (malware)
  • S1095 AhRat software (malware)
  • S1092 Escobar software (malware)
  • S1082 Sunbird software (malware)
  • S1079 BOULDSPY software (malware)
  • S1080 Fakecalls software (malware)
  • S1077 Hornbill software (malware)
  • S1069 TangleBot software (malware)
  • S1061 AbstractEmu software (malware)
  • S0655 BusyGasper software (malware)
  • S0577 FrozenCell software (malware)
  • S0558 Tiktok Pro software (malware)
  • S0550 DoubleAgent software (malware)
  • S0551 GoldenEagle software (malware)
  • S0544 HenBox software (malware)
  • S0535 Golden Cup software (malware)
  • S0529 CarbonSteal software (malware)
  • S0507 eSurv software (malware)
  • S0505 Desert Scorpion software (malware)
  • S0506 ViperRAT software (malware)
Show all 54 ›

References