  Investigating network covert channels in smartphones has become increasingly
important as smartphones have recently replaced the role of traditional
computers. Smartphones are subject to traditional computer network covert
channel techniques. Smartphones also introduce new sets of covert channel
techniques as they add more capabilities and multiple network connections. This
work presents a new network covert channel in smartphones. The research studies
the ability to leak information from the smartphones applications by reaching
the cellular voice stream, and it examines the ability to employ the cellular
voice channel to be a potential medium of information leakage through carrying
modulated speech-like data covertly. To validate the theory, an Android
software audio modem has been developed and it was able to leak data
successfully through the cellular voice channel stream by carrying modulated
data with a throughput of 13 bps with 0.018% BER. Moreover, Android security
policies are investigated and broken in order to implement a user-mode rootkit
that opens the voice channels by stealthily answering an incoming voice call.
Multiple scenarios are conducted to verify the effectiveness of the proposed
covert channel. This study identifies a new potential smartphone covert
channel, and discusses some security vulnerabilities in Android OS that allow
the use of this channel demonstrating the need to set countermeasures against
this kind of breach.
