Active Call Detection

Social engineering scams pose a serious problem for today’s banking and fintech apps. Malicious actors try to trick users into sending money away or into performing other harmful activities such as approving access to their accounts. This is often performed by direct phone calls. The actor first gains the user’s trust and then instructs him/her directly to perform a harmful action. For this reason, active call detection is an integral part of a financial app. The app can use the detection to prevent the user from doing sensitive operations while off-hook.

Malwarelytics for Android is able to detect active calls. It can detect phone ringing, ongoing phone calls, and idle devices. In some cases, it can detect even more - ongoing audio/video VoIP calls, call redirects, and call screenings. Detection of these details depends on the version of Android OS and the apps handling the non-telephony calls.

Configuration

This feature can be configured during the Malwarelytics initialization phase:

val raspConfig = RaspConfig.Builder()
    .activeCall(SimpleDetectionConfig)
    // configuration of other RASP features
    .build()

Available values of SimpleDetectionConfig:

Active call detection defaults to SimpleDetectionConfig.Notify.

Usage

After initialization, the active call detection feature can be accessed via RaspManager. This can be used to register an observer or to trigger a manual active call detection check.

Registering an Observer

Active call detection can trigger a certain action. To achieve that, an observer needs to be configured and registered.

Observer configuration:

val raspObserver = object : RaspObserver {
    override fun onActiveCallDetected(activeCallDetection: ActiveCallDetection) {
        // handle active call detection
    }
    // handle detection of other RASP features
}

The observer can be registered in RaspManager. When it is no longer needed, it can be unregistered again.

raspManager.registerRaspObserver(raspObserver)
raspManager.unregisterRaspObserver(raspObserver)

The ActiveCallDetection data class contains the following properties:

The data class also contains the following functions:

Available values of CallState:

Triggering a Manual Check

Active call detection check can be triggered manually in RaspManager. Two methods are available - isCallActive() gives a simple boolean answer, whereas getActiveCallDetection() provides more details.

val isCallActive: Boolean = raspManager.isCallActive()
val activeCallDetection: ActiveCallDetection = raspManager.getActiveCallDetection()