Slashdot Mirror
Mobile Game Trojan Calls the South Pole
UgLyPuNk writes with an excerpt from Gamepron.com: "Freeware games can actually cost you more money than their pay-to-play cousins, as mobile gamers in the UK have learned. A 'booby-trapped' version of a popular Windows Mobile game has been sneakily spending their money while they sleep – by dialing phone numbers in the Antarctic behind their backs."
...how they even *found* numbers in the Antarctic. It's not like you can set up a phone line down there, and I can't imagine many people would have occasion to call the Antarctic.
Air is just like fog, but it's not gray.
Crappy brain dead design strikes again.
Why on earth are mobile phone apps even allowed to make calls in the first place, without some sort of specificaly made user authorization?
Surely that should be something that has to be done on a per-application basis, and only after the user has allowed it by entering an authorization password to allow the app to access those parts of the phone!?
There should also be a way to limit the number or costs of calls (per application) that is built in at the lowest possible level too.
Simmilar examples can be found in:
1.) Back in the good old days of dial-up, there were adult sites that would give "free" access assuming you (stupidly/unknowingly) dialed into a south-pacific island nation number that had a north American prefix, with your unlimited long distance account.*
2.) All the cell joke and ring tone numbers you can "get for free" that are/were advertised on TV.
*my brother found out about this the hard way
I don't know about angles, but it's fear that gives men wings. -Max Payne
Might be using some software bug to circumvent the prompt but yeah.
Justice is the sheep getting arrested while an impartial judge declares the vote void.
the problem is that a secure design would show a popup like:
do you want to call this 00431341424345 number with your modem (yes/no/always allow this number) every time the modem driver engage
instead windows 7/vista shows us a popup like:
the application solitaire.exe requires you authorization to continue (yes/no)
and that popup is so common that users click trough it without a second thought.
This is almost triggering nostalgia. I remember the good old days where viruses were actually malicious to the system they were installed on. None of this run silently in the background bot zombie we'll use your resources if we need it to further our own gain crap.
In the good old days a virus just wasn't a virus if it didn't format your C: on some arbitrary birthday of the writer, or nuke your master boot record, or even copy itself to the master boot record so that when you started up the computer said Suck It! Rather than displaying the Windows 3.11 loading screen. Man it sucked re-installing dos and windows from floppies.
Nerds can enjoy the same joke over and over for periods much longer than 10 years. It means we don't need to spend a lot of money on entertainment, assuming of course that we actually did spend money on entertainment instead of pirating it. Did I mention that peg legs and eye patches ARRR still funny, too?
... software bug ....
Oh I hardly think that likely...
I guess that whole "Is your refrigerator running" crank would be sort of un-funny given the circumstances....
Frankly, the kiddie vandal stuff was way less dangerous than the pro-level sneaky botnet crap we put up with now. Yeah, it sucked for the target(whereas, with a sufficiently powerful machine, your modern malware victim can limp along for months); but diseases virulent enough to kill their hosts swiftly don't spread as well, and don't have time to spam.
It would be ugly, for a while; but if more modern viruses nuked their hosts, as opposed to quietly lurking and spamming, the internet would be a safer, cleaner, place today.
All of the 3rd party code in the App store is reviewed and no code is placed into the App store until review is complete. This sort of hack, which would have to use non-standard API's to accomplish this, is exactly what such reviews would find. Love it or hate it, it is an effective tool in finding such malware. It is not a catch all, but is an important piece.
"You are aware that Apple don't review code before it is added to the shop right?"
This isn't freeware. It was a shareware version of a "pay" game that was cracked and injected with malware. Why does the summary make it look like freeware is more dangerous than pay-to-play? This is just another case where warez is more dangerous than legitimate software.