Microsoft Engineer Discovers Android Spam Botnet, Google Denies Claim

An anonymous reader writes "Microsoft engineer Terry Zink has discovered Android devices are being used to send spam. He has identified an international Android botnet and outlined the details on his MSDN blog. A closer look at the e-mails' header information shows all the messages come from compromised Yahoo accounts. Furthermore, they are also stamped with the 'Sent from Yahoo! Mail on Android' signature. Google has denied the allegations. 'The evidence does not support the Android botnet claim,' a Google spokesperson said in a statement. 'Our analysis suggests that spammers are using infected computers and a fake mobile signature to try to bypass anti-spam mechanisms in the email platform they're using.'"

Comments

Just link to the ACTUAL blog entry

[Anonymous Coward]

Would it kill you to link to MSDN - where the blog entry actually resides? I get the anti-MS sentiment (although jeez, quit living in the 90s), but making readers jump to ZDNet first (or sending them back to /.) is just being passive aggressive.

Re:Just link to the ACTUAL blog entry

[John3]

Here's the original blog entry.

Re:Just link to the ACTUAL blog entry

[Unoriginal_Nickname]

Microsoft is evil in the same way that suicide is a sin. We're talking about a company that's only relevant on one doomed platform, choking to death on too many brands and too many failed attempts to enter other markets. Unix is everywhere. Unix beat Microsoft a long time ago.

Stop poisoning the discourse by giving Microsoft such a disproportionate share of the hate. Adobe's just as bad, and Oracle's a lot worse. Why don't you rail against them? Why don't we talk about how, once Windows is gone, our only practical choice will be between a walled garden or an operating system that's philosophically dominated by the toxic, vapid musings of a man who literally believes that it is better to let your children starve to death than ply your trade as a software developer?

Re:Just link to the ACTUAL blog entry

[hairyfeet]

It don't smell like a Joe Job to me, its smells like another Yahoo bug. Those that read one of my previous journal entries here knows that there was a bug that would let anyone surfing with FF who had a Yahoo account send spam thanks to a hidden iFrame, and frankly looking at my spam folder there is a LOT, I mean a hell of a lot, of spam both coming from Android and from regular but with ONE thing in common...Yahoo.

I have to wonder if the spammers haven't found a way to use the same bug they used on FF on Android, because yahoo's new layout seems especially weak to this form of attack it makes more sense that they are using a browser hack than having the entire Android system compromised but who knows? There are a hell of a lot of older Android versions out there, maybe they found a weakspot in the 2.x line and are hitting it.

But in the end somebody needs to be talking to the security guys at Yahoo and find out what they are using to hit their emails, be it a browser hack or something nastier.

Engineer is backtracking

[John3]

There is a follow-up blog post where Zink backtracks a bit and admits the headers could be forged.

"In comments of various blogs a lot of people have suggested that these headers are spoofed, or there was a botnet connecting to Yahoo Mail from a Windows PC and sent mail that way. Yes, it’s entirely possible that bot on a compromised PC connected to Yahoo Mail, inserted the the message-ID thus overriding Yahoo’s own Message-IDs and added the “Yahoo Mail for Android” tagline at the bottom of the message all in an elaborate deception to make it look like the spam was coming from Android devices."

Re:Engineer is backtracking

[Anonymous Coward]

"Elaborate deception" -- If that's his idea of elaborate, I wish he worked in marketing and not software!

Re:Why not?

[AmberBlackCat]

(most users just click yes to anything)

On Android, you have to. Your only options are accept everything or you don't get the app.

Re:A Microsoft engineer?

[MrDoh!]

I believe him.
Sent from my Cray Supercomputer. BillGates@Microsoft.com

Re:Go Microsoft

[thatseattleguy]

And if anyone knows how to take what should be a simple, straightforward, technical discussion and turn it into a MS vs Google flame war, it will be Slashdot commenters.

Is it just Yahoo?

[whoever57]

I see emails from compromised accounts. The one thing that appears to be common is that it is always from Yahoo accounts. After one of my friends had her Yahoo account compromised, I throughly scanned her PC -- nothing showed up. I scanned the hard drive while connected to a known clean PC, so it wasn't just a well hidden malware.

I am beginning to wonder if there is a vulnerability in Yahoo's security that is being used to compromise accounts.

Re:Is it just Yahoo?

[Billly Gates]

The answer is a Firefox exploit with an invisible iFrame. I have seen it myself and Hairyfeet noticed the same thing if you browse some porn sites with Firefox after you log in your account will randomly start spamming people.

Basically it is an iframe rogue ad which looks identical to the yahoo email login and it uses javascript to place it over the real yahoo login from yahoo.com. Since the iframe is invisible in Firefox you have no clue and just click on it and give in the username and password.

I wonder if Mozilla fixed this?

Re:Why not?

[Anonymous Coward]

To be clear, Cyanogenmod 7 contains permission management. This feature was dropped in Cyanogenmod 9.