Slashdot Mirror
Mobile Game Trojan Calls the South Pole
UgLyPuNk writes with an excerpt from Gamepron.com: "Freeware games can actually cost you more money than their pay-to-play cousins, as mobile gamers in the UK have learned. A 'booby-trapped' version of a popular Windows Mobile game has been sneakily spending their money while they sleep – by dialing phone numbers in the Antarctic behind their backs."
aw man, that's pretty cold.
Windows virus writers strike again.
and what did they say ?
It sucks enough here with the cold, now I have the phones ringing off the hook!!
I always thought Microsoft made a bit of a branding error when it came to naming their mobile OS. "WinCE" just invites all kinds of negative associations, and stories like this one just add to the painful image.
Cheers,
"What in the name of Fats Waller is that?"
"A four-foot prune."
....how about a nice game of Ice Station Zebra?
Just like to point out that as the UK is not part of the eurozone euros are not the currency of the UK; the cost is roughly £4 per minute (which equates to roughly 5 euro or roughly 6 US dollars).
...how they even *found* numbers in the Antarctic. It's not like you can set up a phone line down there, and I can't imagine many people would have occasion to call the Antarctic.
Air is just like fog, but it's not gray.
I guess this is their revenge for Happy Feet
Comment removed based on user account deletion
I seriously want to call this number. My guess is that the would not have a transoceanic sea line, so it would have to be an Iridium phone that picked up on the other end.
Anyone have details?
If the penguins could get a pay phone set up in Antarctica they could make a killing calling 1-800 numbers all day.
According to Wikipedia, there is no international dial code for the antartic
10 ?"Hello World" life was simple then
So I've been reading Slashdot for a couple of years now and I'm thoroughly confused about how we decide which stories deserve the community's notice.
What happens is kwadson looks at the story, and if it's anti-MS, he posts it. (This is not a complete description of the process.)
(And to be fair, this story is much less flamebait than some of the FUD that he's put on the front page.)
Simpsons did it.
http://www.wtng.info/wtng-672-au.html Base Old format New format Casey +672 12 8xx +672 12 8xxx Davis +672 10 6xx +672 10 6xxx Macquarie Island +672 13 9xx +672 13 9xxx Mawson +672 11 7xx +672 11 7xxx
I saw this on the BBC website too, but neither article tells me how it is to the advantage of the hackers to give random people big telephone bills. Do the hackers own some little phone company which the calls are going through? Do they have some overpriced premium number connecting to a computer in Scott Base which recites astrology readings in a synthetic voice?
More seriously: why should the phone OS allow a game to initiate phone calls? (I really hope the answer is 'the OS has a bug' rather than 'that's how they designed it.')
Quattuor res in hoc mundo sanctae sunt: libri, liberi, libertas et liberalitas.
Hernk the planet squaaack!
Symbian phones at least require you to explicitly give discrete permissions to the programs you put on them. Do you want to allow access to the gprs? do you want to allow read acess to personal data? to memory stick? write access? sms? calls? stupid for windows phone to let them randomly allow or stupid for people to give a game those permissions.
http://www.theregister.co.uk/2010/04/09/windows_mobile_trojan/
Yes that was on ElReg 2 months ago.
One of the problems with mobile apps is the "allow and install" vs "deny and not install". You read the list of privileged operations and you are left with a tough decision and no middle ground - which would be "deny and still install". If I read the list of requested privileged applications I often get a shiver.
You'd think SOMEONE would actually tell us the name of the game responsible?
Seems like that should have been in the headline or story.
("3D Anti Terrorist Action" by the way)
But no, I suppose it's more important to emphasise that it's Windows.
Slashdot. Old school journalism at its finest.
("There's a chemical in your home which may kill you. We'll tell you what it is, after these important messages")
Which way do your toilets flush down there? Clockwise or anti-clockwise?
Running any application on your phone from untrusted sources produces unexpected results. Clip at 11.
What I don't exactly see is how they're profiting off the number.
There are plenty of providers of international premium rate numbers that will ask no questions about the callers and deposit a percentage of the call termination fees into a bank account at the end of the month - the article mentions they used Somalia ($0.14/min), Dominica (€0.45/min), Antarctica (€0.46/min). The provider I linked to was the top of Google's search - you can probably find others offering higher rates.
It should be a simple matter to follow the money back to the source of the problem
Not really. These crimes cross multiple legal jurisdictions, and there is no evidence to tie the trojan writer to the person profiting from the calls. Authorities in, say, Switzerland, will not break the banking secrecy of an individual just because they profited from running a premium rate phone number.
I remember hearing a story back in the early 90s about a French guy who had over 30 land lines installed in his house, and had set up an automated blueboxing dialler to call international premium rate numbers 24/7. Allegedly, he was earning $1.50/min from each call, and he quickly became a millionaire.
The island of Diego Garcia used to be a favourite for such phone scams. Phone companies have international agreements to tranfer money, a portion of what they bill for international calls. In the case of the scam calls to Diego Garcia the money could be siphoned off by middlemen because Diego Garcia did not have agreements with all phone companies (bad credit rating?) and the money was routed indrectly. Something similar is happening here. The Irish Communications Regulator blocked direct dial calls to a list of countries to cut down on such fraud http://news.cnet.com/Ireland-launches-phone-fraud-crackdown/2100-1036_3-5377387.html
Why would you allow an app access to the dialing functions on your phone?
Oh, wait, Windows Mobile. I hope that they've ring-fenced / sandboxed these functions on Windows Phone 7, like Android has.
This article is mistagged as a 'worm', it should be tagged as a 'logic bomb'.
A worm is a piece of software that is able to propagate itself without interaction from a user. A logic bomb is a piece of software or a function in a piece of software that activates when certain conditions are met.
I guess that whole "Is your refrigerator running" crank would be sort of un-funny given the circumstances....
I find that there actually exists a "popular Windows Mobile game" the most interesting part of this story!
K Man
The permissions on Android are OK, but for IP access are too vague. Since I pay per Kb, I'd like to have a per-domain permission or a per-access notification.
Moreover, all the programs I downloaded triggered "network access" warning on install so I would not be surprised if "whoopieCalc" did so. Security breach by desensitivation FTL.
You're not old until regret takes the place of your dreams.
Somewhere on McMurdo Station
Bob: ZzzzZZZzz
Phone: *ring* *ring*
Bob: Zz*wha* hello?
Phone: *ScreeEEeeeEee*
Bob: Hey, HEY THIS ISN'T A FAX! PICK UP! PICK UP! *slam* morons
[John]
Shit better not happen!
Apple's "totally controlling the users" method pays off in cases like this. If you had an iPhone, it would have been impossible for something like this to happen. Even a jailbroken iPhone (which allows you to play unofficial apps) is safe from this kind of thing because the jailbreak hack doesn't remove Apple's security from the iPhone OS. If an app wanted to place a call, the OS displays a pop-up saying "CALL 1-555-1212" and you must press OK to call it. Similarly, no application can gain access to your GPS location without asking you the first couple times you open it.
So, apps that track your location without you knowing it, or make calls without you knowing it are impossible on the iPhone. Apple isn't totally crazy after all.
This isn't freeware. It was a shareware version of a "pay" game that was cracked and injected with malware. Why does the summary make it look like freeware is more dangerous than pay-to-play? This is just another case where warez is more dangerous than legitimate software.
Who is using Windows Mobile? Release this for iPhone or Android and then you can make some money.
The reason installing applications on linux takes root priv is because the installation requires modifications within non user filesystem space (/usr/bin, /usr/local, /usr/share), typically installing applications in *nix requires installation in far more than just a user's &home directory, not least because the ability to execute applications from a user's home dir may be disabled without root privs. I believe this is called having a decent security model.
There are iPhone and Droid apps both that can dial out. On either platform, my VOIP apps have access to my phonebook, and can dial out through the phone itself rather than just VOIP. The trick is though that in the "store" they do tell you what an app is capable of doing, although sometimes the info is a bit broad.
For apps that want root access, you must authorize them on the Droid (iPhone is supposed to be no-root in general, droid needs to be cracked fist).
For work I have an old blackberry, and when you launch an app it asks for permission to run or be whitelisted. I haven't found one that does dialing, but from what I've seen of the security layers it might need special permission for that.
When it comes to smartphones, the iPhones is still dominating entertainment, the Droid is growing quickly and becoming more versatile, but the blackberry really does seem to have started out-of-the-gate with a greater focus on security.
Anybody remember this one? I don't know that it actually *DID* anything to the computer, but it got around faster than crabs on a $5 hooker.
Infected disk put in machine = infected machine.
Clean disk put in infected machine = infected disk
Back in high school, that thing was rampant until they get a decent TSR antivirus. It slowed the computer down a lot, but it did manage to spank the monkey before it infected the PC's.
There is no civil society in Antarctica - none. I do not believe that there is as much as a convenience store in the entire continent. So who, pray tell, is getting the money from these calls ? The National Science Foundation ? Now, that would be an interesting way to expand the science budget...
Android's permissions are either all or nothing when it comes to Internet access. And some apps just ask for that permission for no real reason.
Best way to deal with that is to have a rooted phone and Droidwall. However, this won't protect against an app that was installed that was given capabilities of dialing and sending/receiving SMS/MMS items.
Another item to have is an app called autostarts. You would be surprised on what apps want to hook where.
I understand all those words individually, but put together in a sentence like that, they don't make any sense!
I 3 you for showing my the light of Autostarts
GENERATION 26: The first time you see this, copy it into your sig on any forum and add 1 to the generation. Social exper
You moon him? < is your friend.
It seems the developer was a little. *puts on sunglassses* cold blooded. YEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH
No, Symbian and J2ME seriously warns when it tries to do a crazy thing like "dialling a phone number", I cancel, warn the site which I downloaded. So, I am (as well as 1b potential users) a "app store" guy myself.
What I wonder is: Doesn't Windows mobile have such mechanisms? I heard it does.
There isn't really a 'code' for dialing Antarctica... I worked IT at the Amundsen-Scott South Pole Station for the United States Antarctic Program. The US stations employ a satellite link to the Denver headquarters, and from there it's just connected to the network. Dialing "The South Pole" is actually just a Denver number.
Besides all sane download sites should really have at least 3 antiviruses installed and running to check all binary files, it is the architecture of J2ME and Symbian which will seriously alert user with a blocking prompt for _each_ phone attempt done by 3rd party unsigned application.
One must be really stupid to ignore that alert and allow (there is no OK pre-selected) a phone call from game.
What I find hard to believe is: Windows Mobile doesn't have such mechanism?