Slashdot Mirror
New SMS Trojan Found In Android Markets
Trailrunner7 writes "The Android platform seems to have become the playground of choice for attackers and malware authors looking to make a quick buck. The latest example is a premium-rate SMS Trojan that not only automatically sends costly SMS messages, but also prevents users' carriers from notifying them of the new charges. The new piece of malware, which is known as HippoSMS, has been found in unofficial Android app markets in China. This is just the latest in a series of similar incidents in which attackers and scammers have inserted either outright malicious apps or seemingly benign apps containing malware into app markets. Most of the attacks have targeted Android users, and several times Google has had to remove malicious apps from the official Android market."
At least Android users can install whatever they want rather than playing in Apple's walled garden.
That doesn't sound like Apple bashing. Here come the troll mods.
This post comes with a double-your-money-back guarantee!
Any offense taken to this post is at your sole discretion.
Why don't these articles ever tell you WHICH markets and apps are affected? Oh, that's right, they're too busy trying to generate page hits through scare-mongering to care about information.
(I'm not trying to say these aren't legitimate threats: quite the opposite. But, good reporting would help mitigate these threats by publicly shaming and informing.)
I'm having trouble worrying about people who install apps onto their phone without knowing that the market creator is paying attention for that sort of thing. Google and Amazon are alert and watching. Random markets in China? I feel less confident in them.
I feel exactly the same compassion for them that I feel for people who download things from any random website they find.
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
If you want the freedom to install whatever you want from wherever you want, you have to accept that some of those things may not be good for you or your devices. To me, it's worth the trade off.
In the end, the best protection will always be common sense. To those that do not feel they possess enough knowledge to make their own decisions in this regard, there is always Apple who will gladly make the decision for you. To each their own.
and the open apps don't have 30% cut + $99 year
Unofficial Markets. So in other words, Google has nothing to do with this. If you want security on Android, just stick to the standard market. Obviously Third party markets are bad news bears.
if a stranger emails you an attachment, do you open it?
Not goatse but damn close, don't click the link.
As someone who is about to get their first Android device, is there a good resource for practices for protecting it?
Reading the summary, it seems this is a 3rd party market that was infeted. Obviously the first thing is not to install everything you see, followed by don't use 3rd party markets. However there seem to be several 3rd party markets that do have worthwhile software. Is there a suggested list of marketplaces that are reliable?
There also appear to be several Android firewall apps. Is there a site where they are reviewed and compared?
"I use a Mac because I'm just better than you are."
After that, it registers one ContentObserver to monitor incoming SMS messages. Inside the ContentObserver, it will delete any SMS message if it starts with the number "10." Note that the numbers such as 10086/10010 represent legitimate mobile phone service providers in China and are typically used to notify users about the services they are ordering and the information of users' current balance of their mobile phone accounts.
RETURN without GOSUB in line 1050
Non-story. "The new piece of malware, which is known as HippoSMS, has been found in unofficial Android app markets in China." If you load apps from China directly you are asking for this sort of thing. It's nearly the equivalent of going to a "Warez" site for Windows programs.
How about if carriers offer a free service which simply blocks "premium" SMS calls altogether?
Sure, I won't be able to donate $10 to the Red Cross the next time there is an earthquake in a 3rd world country, but at least I'll be legally immune from paying for any that do get through.
Think of it as 976/900-block for SMS.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I had AT&T completely disabled SMS on all my accounts; too many dirt bag bottom feeders sending me spams that is costing me money.
This is exactly the kind of innovative feature that the iPhone users of the world will miss out on.
Yeah, I know, flame bait....
XML is a known as a key material required to create SMD: Software of Mass Destruction
... don't click the link.
pretty sure that bit is the M.O. when browsing /. ;)
That is the typical behaviour of a Fuckle Assdroid user.
I was always of the belief that Microsoft desktop was the most attacked because it was the most popular. It's a good contrast to see how Android is affected by its own popularity
and SMS, if abuse, could drain my account!
a year or two ago, I was with t-mobile and their PAYG plan did not have the ability to turn off sms send or receive! my balance went to nothing and I gave up on that carrier. a few years later, I checked back and now, if you call CS, they can turn sms off even if you are monthly and non-contract.
sms is for kids. I'm a middle aged man. I have no need for this childish bullshit. I do email. if you want me, you call or you email me. email is more in my domain that I can control. sms is purely a carrier thing and I want no part of that. (at least until they remove the fee on RECEIVING texts!)
--
"It is now safe to switch off your computer."
Those who downloaded some malware from china deserved every charge they got billed against them. Those who are crazy enough to trust the Chinese with software deserve to be hacked. Hopefully we can avoid Chinese software but sadly we can't avoid Chinese hardware....
Jehovah be praised, Oracle was not selected
Which is still magnitudes less annoying the iPhone users. Oh sorry, I forgot to call it something stupid like the Crapple iFuck to stay on your brilliantly clever intellectual level.
You know what would be really shocking?
If they found a decent application in the Android market!
Just wow. And people are surprised it's a Trojan? Finding a *non*-Trojan app in a place like that, that'd be the trick!
This a failure on the part of providers. I dont want a "notification" I dont want it at all. Part of signing up should be the ability to limit
#SMS/day
Block "premium" SMS messages with exception list.
Block calls to foreign countries with an exception list
Block toll (900) calls.
IOW give me back control on how and how much they can shaft me.
There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
Try this (loading a custom HOSTS file onto it that's updated vs. maliciously scripted sites, botnet C&C Servers, KNOWN malware makers sites/servers/hosts-domains, & even bogus DNS servers too + anything you wish to add to it for security (and yes, even speed, by hardcoding your fav. sites into it also, which is a LOT faster IP address resolution than calling out to any DNS server by far)):
DO THE FOLLOWING STEPS BELOW: (after obtaining a good reputable solid HOSTS file, like mvps' -> http://www.mvps.org/winhelp2002/hosts.htm , which isn't "MEGA HUGE" either & kept VERY up to date (soon to be updated again this month too))
---
1.) Get ahold of the "Android Debugging Bridge" (ADB) & install it
2.) Mount your system mountpoint as READ + WRITE (as powerful of priveleges as you need is this)
3.) Using the PULL command, copy the file over from your PC (or even on your ANDROID if its there already) using PULL & overwrite the etc. folder's copy of HOSTS
---
DONE!
* Yes, it's THAT simple... &, it works to help make ANDROID phones more secure than they are by default!
APK
P.S.=> Of course, your HOSTS file will need to have the domain/hosts name of the servers this thing "talks to" & what not as well as where it comes from (if you choose to do that of course) to blockout, & that you have to obtain for this to work vs. this threat & others like it...
Anyhow/anyways - Enjoy, it works to help make ANDROID phones a bit more secure!
... apk
So, this is how/why HOSTS files help you in this case: http://nakedsecurity.sophos.com/2011/07/09/android-malware-spies-sms-messages-zeus-family/
PERTINENT QUOTE/EXCERPT:
---
Android malware spies on your SMS messages - but is it part of the Zeus family?
"The Symbian, Windows Mobile and Blackberry modules of the notorious Zeus malware toolkit (also known as ZBot) have been known about for some months, and it has been clear that Zeus gang was interested in developing malware for mobile platforms.
However, until now we have not seen any evidence of Zeus targeting users who own Android or iOS (iPhone/iPad) devices.
This fact was quite surprising to us, considering the popularity of the Android and iOS platforms and the growing prevalence of malware being written for the Google Android operating system in particular.
In the last couple of days, however, there has been quite a lot of discussion on the mobile malware analysis mailing lists about a version of a an Android version of Zeus.
We eventually concluded that this was a malicious application that Sophos products have been detecting as Andr/SMSRep-B since 31st May 2011.
The malicious application pretends to be an Android version of Trusteer Rapport banking security tool, and was served to devices running the Google Android OS by a web server which was set up to deliver Zbot malware to multiple platforms.
After the fact, it was not difficult to connect the Android application with Zeus toolkit, although we could not conclude 100% that there was a connection.
The installed application uses a stolen Rapport icon and displays a simple screen when launched on affected device.
The fake Rapport application registers a Broadcast receiver which intercepts all received SMS messages and forwards the messages to a malicious web server using HTTP POST requests. The stolen SMS messages are encoded using a JSON encoding scheme, often used by various web services.
Although the application is clearly designed to steal the content of SMS messages, its not very sophisticated.
That's why we cannot be 100% sure that this is indeed a part of the Zeus kit. The URL of the command and control server is hard-coded into the source code, for example, which makes the application quite inflexible for installation on an alternative server.
Nevertheless, this malicious Android application is interesting as it combines spyware functionality with the concept of fake security software. As we've seen recently in the Mac OS X world, fake anti-virus software is one of the most common themes adopted by malicious hackers in their attacks.
Eventually, the doubt whether this is really part of the Zeus family or not remains. I suppose only the developers of Zeus kit know for certain.
Unfortunately I have no means of contacting them, and even if I did I doubt they would be prepared to confirm or deny this theory." - by Vanja Svajcer on July 9, 2011
---
FROM -> http://nakedsecurity.sophos.com/2011/07/09/android-malware-spies-sms-messages-zeus-family/
* For YEARS now, I've been adding ZEUS botnet's hosts-domain names to my HOSTS file & IP addresses it uses (by far the minor one in IP Addys vs. host names) to my router firewalls & software firewall (Windows 7's native one) here, from this source for that data (which YOU may find useful too - especially in THIS case, vs. this particular ANDROID malware):
https://zeustracker.abuse.ch/monitor.php?filter=online
(Enjoy & I hope this is helpful to you ANDROID users out there...)
APK
P.S.=> ANDROID's unfortunatley just showing you all that Linux (which has more unpatch
Zitmo/ZEUS hits Android:
http://blog.fortinet.com/zitmo-hits-android/
---
"Lately, there's been an active discussion on technical forums regarding ZeuS targetting Android users. We finally managed to get our hands on the mobile sample the ZeuS PC trojans are propagating. Actually, it is not a new sample and has been detected under several names (Android.Trojan.SmsSpy.B, Trojan-Spy.AndroidOS.Smser.a, Andr/SMSRep-B), but it is far more scary when propagated by the ZeuS gang... In the background, it listens to all incoming SMS messages and forwards them to a remote web server. It's simple, but just enough for the ZeuS gang to grab your banking mTANs...
---
* "Read ALL about it...", hot off the presses!
APK
P.S.=> Further proof that once an OS of ANY KIND (yes, kids - INCLUDING LINUX) gets high marketshare on a given platform, it absolutely WILL get exploited by the malware-maker/hacker-cracker... and YES, even Linux variants like ANDROID!
... apk