Android users searching for pornography on their smart phones could be in for a costly surprise.
During the course of researching the origin for the first SMS Trojan for Android devices, I found a new Android package masquerading as a porn media player but which instead sends SMS messages to premium rate numbers.
The SMS messages cost $6 each and are sent silently in the background without the user's knowledge.
The latest Android malware (detected as Trojan-SMS.AndroidOS.FakePlayer.b) is being distributed via clever search engine optimization (SEO) techniques, a clear sign that cyber-criminals are making every effort to infect mobile devices. The use of SEO is a significant development that confirms our belief that mobile malware - especially on Android devices - is a potentially lucrative business for malicious hackers.
The code in the latest variant is similar to the first version and I'm pretty sure the same person (or group) is involved in creating and distributing this Trojan. It is currently targeting Android users in Russia.
The fake porn player does not have a user interface. Once installed, it simply drops an icon (an adult-themed photograph) on the smart phone's screen and starts sending premium SMS messages without the user's knowledge whenever the app is launched.
The malware is not available in the official Android app store. It is being distributed via Web sites but, with the search engine optimization techniques being used, there is a likelihood this is infecting a lot of users.
Like all Android apps, the user is prompted to manually install and allow the application to access certain parts of the operating system. This should serve as an immediate warning, especially since media players should not require access and permission to send SMS messages.
As I said in my previous blog entry on this topic, Android users should pay close attention to the services an application requests to access. Automatically permitting a new application to access every service it requests means you could end up with malicious or unwanted applications doing all sorts of things without requesting any additional confirmation. And you won’t know anything about it.
'IT 보안소식' 카테고리의 다른 글
| KT, 추석 보너스 "환급금 알아보기"!! 놓치지 마시고 꼭 해보세요!! 국번없이 100번 (2) | 2010.09.10 |
|---|---|
| Malware Diaries - New Adobe Reader/Acrobat zero day vulnerability (0) | 2010.09.09 |
| 애플(Apple), iPhone iOS 4.1 업데이트 발표 (2) | 2010.09.09 |
| 온라인게임 계정 탈취와 ARP Spoofing 공격에 대한 로그 및 간략분석 (2) | 2010.09.07 |
| 알약(ALYac), ARP Spoofing 공격을 실행하는 온라인 게임 계정 탈취 악성코드 주의 (0) | 2010.09.07 |
댓글