SMS Trojan Steals From Android Owners

siliconbits writes "A Trojan posing as a media player for Android smartphones automatically sends text messages to premium rate numbers, according to Kaspersky Lab. Company officials say the Trojan, dubbed Trojan-SMS.AndroidOS.FakePlayer.a, is the first of its kind for the Android platform, even though SMS Trojans are currently the most widespread type of malware on mobile phones."

Comments

Is this really a trojan?

[schon]

Or does it tell you what it's gonna do beforehand?

If you install something that says "THIS WILL COST YOU MONEY", and it sends SMS that costs you money, how exactly is that a "trojan"?

Re:Is this really a trojan?

[SCPaPaJoe]

I Agree. When I first got my Droid, I was going to install a free game until I saw it wanted access to by contacts list. The notification screen during app install is quite clear and easy to understand. There is no excuse for not reading it.

Re:Is this really a trojan?

[flibuste]

In all honesty, the way Android reports what an application uses is way too weak and not granular enough. Basically, you require access to 1 URL, your application needs "Full Internet Access". Want to access the GPS data? Your application needs "Location access", "Services that may cost money", etc.

The way an application declares its "needs" is through an element in the Android Manifest file. However, the choices are really limited to the existing Android services, and most of them have a 1 to 1 relation with the services they relate to, and nothing more granular such as "Requires GPS access using only satellites (costs nothing)", "Requires GPS access using cell towers", "Requires GPS access through paying services".

In the end, the user downloading an app sees warning that are mostly meaningless, and which appear in many other applications. It's close to impossible to spot a possibly-offensive application such as this Trojan.

Re:Is this really a trojan?

[metamatic]

Is it possible for an app to request access to the filesystem, then modify another existing app with a payload that makes it do all the dirty work?

No. Each Android app runs as a separate Linux userid. Even if you give the app filesystem access, it can't write to files that belong to other apps, let alone rewrite the apps themselves.

Re:Is this really a trojan?

[Sancho]

The manifest says, in big bold letters, that the app may cost you money by placing phone calls and sending SMS.

Re:Is this really a trojan?

[Anonymous Coward]

In all honesty, the way Android reports what an application uses is way too weak and not granular enough. Basically, you require access to 1 URL, your application needs "Full Internet Access". Want to access the GPS data? Your application needs "Location access", "Services that may cost money", etc.

Do you use Android? It is more granular than that. Location access can specify coarse (cell location) and fine (GPS). "Services that may cost money" can specify SMS or phone calls. Many apps use a "Phone" permission that's called "Read phone state" so that it can know when you're receiving a call. Apps like Google Voice that use the "Phone" permissions also include things like "Make outgoing calls" and "Intercept calls".

Your fine-grained permissions are right there.

Re:Is this really a trojan?

[mjwx]

Out of curiosity, how does a Windows user gain access to the iPhone's file system? Is there even a removable storage card on an iPhone, or is the entire phone a USB mass storage device?

They dont. No MSC functionality what so ever. All communication with an Iphone is done through Itunes.

True, and if the Android were to move to a better file system than FAT32, that's probably the best way to do it

Android already uses a newer file system. The / is YAFFS2. Only /SDCARD is VFAT and this can be reformatted to EXT3 if the user wants. FAT32 is only there for compatibility with OS's that cant read EXT file systems

Re:Read the TFA?

[unix1]

Found the original announcement. No name of an app there either.

While there could definitely be such an app, the article definitely sounds like an advertisement for their product rather than a security notification.

Bad summary

[esocid]

After trudging through several articles, not one mentions the application's name. It does however mention that the trojan can be packed into basically anything. It also doesn't mention that only users in Russia are affected by the SMS charges.

According to Denis Maslennikov, Senior Malware Researcher at Kaspersky Lab, there's not an exact number of infected devices available at present, but the outbreak is currently regional. For now, only Russian Android users can actually lose money after installing the Trojan, but anyone can be infected.

http://www.readwriteweb.com/archives/first_trojan_for_android_phones_goes_wild.php

Re:Bad summary

[esocid]

Also forgot to mention, it isn't in the market. It has to be manually installed, with that little box checked to allow non-market apps to be installed.

Re:Hahaha

[ViViDboarder]

False

Re:So...

[shmlco]

"Oh and why do you capitalize the 'middle east'? Is it a country now, worthy of promotion to a proper noun?"

Doesn't need to be a country. Region names are capitalized when they stand alone and are widely understood to designate a specific geographic (or geopolitical) area. e.g. Southern California, the Bay Area, the Middle East.

http://www.utexas.edu/visualguidelines/capitalization.html