Android Stalkerware Surge & Legacy XP Exploits Spotlighted at RSA 2021
What Happened – ESET researchers presented new findings at RSA 2021 on two fronts: (1) a 48 % year‑over‑year rise in detections of Android stalkerware, with more than 80 families examined and critical privacy‑related code flaws uncovered; (2) continued abuse of vulnerable Windows XP binaries that can be leveraged on modern systems via “living‑off‑the‑land” techniques, extending the attack surface of legacy code.
Why It Matters for Trust & Control Assurance
- Unvetted mobile apps bypass traditional endpoint controls, creating a blind spot for data‑exfiltration monitoring – a scenario continuous control‑assurance programs must detect and evidence.
- Legacy binaries that remain executable on current OSes undermine baseline hardening controls; without systematic evidence of remediation, audit readiness is weakened.
- Mapping these emerging threats to a unified control set (e.g., access, configuration, monitoring) demonstrates due‑diligence across multiple frameworks.
Who Is Affected – Enterprises with BYOD or mobile‑first workforces, organizations still running legacy Windows components, and any entity responsible for protecting personal data on mobile devices.
Recommended Actions
- Conduct a mobile‑app inventory and enforce strict vetting/MDM policies to block unauthorized stalkerware.
- Identify and isolate legacy XP DLLs or binaries; apply compensating controls (application whitelisting, sandboxing) where removal isn’t feasible.
- Capture continuous evidence of these controls (policy enforcement logs, endpoint telemetry) to support audit and compliance reviews. Source: ESET RSA 2021 announcement
Technical Notes
- Stalkerware apps exploit Android permissions and insecure data‑transmission APIs, enabling covert collection of contacts, location, and microphone/audio.
- XP exploits rely on vulnerable DLLs that can be invoked by signed system tools, allowing privilege escalation even on non‑XP hosts. Source: same as above