Slashdot Mirror
Android Malware Intercepts Text Messages, Forwards To Criminals
An anonymous reader writes "A new piece of Android malware has been discovered that can intercept your incoming text messages and forward them on to criminals. Once installed, the trojan can be used to steal sensitive messages for blackmailing purposes or more directly, codes which are used to confirm online banking transactions. The malware in question, detected as "Android.Pincer.2.origin" by Russian security firm Doctor Web, is the second iteration of the Android.Pincer family according to the company. Both threats spread as security certificates, meaning they must be deliberately installed onto an Android device by a careless user."
This'd only be newsworthy if it's installed via Google Play or another mainstream source. Otherwise, it's just stupid people paying the price for their ignorance.
I love that Android is so FREE!
Attorney General Eric Holder for instance.
'I don't know what it's called. I just know the sound it makes, when it takes a man's life.' ~ Four Leaf Tayback
From TFA,
Although Doctor Web doesnâ(TM)t say so, the good news here is that Pincer2 is not likely to be very prevalent. It has not been found on Google Play, where most Android users should be getting their apps, and appears to be meant for precise attacks, as opposed to being aimed at as many users as possible.
In short, this malware threat isnâ(TM)t one that you will likely be hit with, but it is an interesting example of how Android malware is evolving.
Don't give Facebook ideas.
I thought the word careless was assumed to proceed user. I think that basically every slashdotter has been called to help some "careless" user who has 3 toolbars, 2 AV bloatwares, and countless other bits of crap that came along with all their downloads. Yet they will swear on a stack of bibles that "they never installed nothin' "
So any malware that depends on users being careless will be a huge success. The other key will be ease of use.
That being said, I generally stick with my brother's rule: "I wouldn't transmit it electronically if I wouldn't want it on the front page of a national newspaper." My niece texted me her password the other day; I pointed out the error of her ways.
I did just come up with an app for Google glasses. You send someone encrypted messages that are displayed on their screen as a QR code. Their glasses decrypt it temporarily while it is in view. The phone can't decrypt, the glasses don't store. Glasses can still get hacked though but at least you do not have a plaintext message store.
The potential for Malware is just too high. Every geek will 'blame the user' but it's time to take responsibility and blame the platform.
I constantly, repeatedly and persistently tell everyone who asks to buy an iPhone. The platform is safe. No ifs, ands, buts or blaming the users for their stupidity. If it can go wrong, it will go wrong.
This is just the leading edge of the wave. If the authors can get this into the Play store, they will. It's just a matter of time before Android phones become infected with premium line diallers and other wonderfully creative nasties. The 'Free' platform is slowly becoming the 'Free for all' platform.
16.9 million results.
No platform is safe from user stupidity.
Why would anyone engrave "Elbereth"?
A stupid user is a stupid user. Everyone is so quick to rush to the soapbox and preach how wonderful their platform of choice is and how awful the others are. I say rush to the box and preach how stupid people are. I say rush to the box and demand that basic computing security be taught to everyone just as proper hygiene and safe sex are. We do not need big brothers, we don't need walled gardens, we need people to know what the hell it is that they're doing with their electronics. Teach people to wash their damn hands, avoid disenfranchised Nigerians, stop opening random email attachments, and stop bloody installing apps that require access to your sensitive data.
Two of my imaginary friends reproduced once
Since most of my texts are intended for criminals anyway, this doesn't seem to be that big of a deal to me.
penis penis penis ..repeat
16.9 million results.
But what can any iPhone trojan actually do? It's limited to sending contacts (and that only IF the user allows it at the time it tries to access the contacts, not on install). It can send the users location IF the user agrees to have the location accessed, at the time the app tries to access location (not on install). It can send your photos to them IF the user agrees to allow access to get to the photos... you get the picture.
What CAN'T it do? It can't access or send SMS messages. It can't access or send email messages (at least not without the user hitting send on the email). It can't make a phone call without the user saying "why yes I would love to dial that number now which is clearly displayed to me in full".
The issue is that because Android makes you agree to what it can do up front, most non-technical users will simply agree to anything, and then the app can really DO anything it likes to the user. There are safegaurds technical users can install; but they are exactly the people who do not need protection or help!
Android is a platform built for the pleasure of the technical elite, with a promise to non-technical users of being their gateway into the new world of mobile computing. But that is a lie; it's simply a PC you can put in your pocket that brings along for the ride every ill ever conceived of on a PC and more besides.
Android could go a long way by simply grantng permissions for things at the time the app wants them as iOS does; but even then the fundamental problem is that there are so many permissions that extend so deep into the system that it allows apps to do things like intercept SMS. You can't take those away now without technical users crying foul, but the cost to non-technical users is monstrous.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
But standing at a bus stop and spotting someone sharply-dressed, I could ask to use their phone
You just had to get close enough to have it automatically installed over NFC. No need to have your face ever seen.
Or just install it under a bench at the bus station and have it email you the targets acquired remotely along with images and recordings of whatever conversations they might have had there.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
What people miss is that iOS is MORE customizable for users by default in the ways that matter most. As you say, Skype having my contact list? Hell no!
Or Google Maps app having my location or contacts or anything whatsoever? Don't think so! All I have to do is say no, but I'm still using the app.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
There are many Linux virii like this. You must install the virus yourself, allow execution privileiges, then start it yourself. You could even write your own (this one would wipe out your entire hard disk): ...then run it: ./myvirus ... Have fun!
vi myvirus
#!/bin/bash
rm -rf /
wq!
then you would have to change the file to give it execute permissions (and while you're at it, change its ownership to root):
chmod a+x myvirus
chown root.root myvirus
Maybe now they will stop thinking of Cell Phones as a "trusted" device. It's not really. Very easy to lose, very easy to steal, and it's supposed to be a trusted source for two factor authorization?
Be seeing you...
I would like to know why Google keeps this forward-to-criminals API in their SDK?? I hope they are responsible enough to pull this API and keep only forward-to-police one.
I don't feel well when my device can communicate with criminals in any way, and I believe Google will address this!
TIA Google!
http://opencm3.net, http://www.nongnu.org/gm2/
Snakeoil salesmen aren't really proof of a need for their product.
Help stamp out iliturcy.
And the criminals quickly shut it down after receiving tons of texts saying "Hey U up?" followed by a phallic image
I have my mobile service provider block 5 digit codes. Security for android needs to be beefed up.
So how do you act, given that you don't know whether or not it's malware? You don't install it, because you think it might be malware. [...] There's no difficulty. It's that simple, to keep free of malware. It has nothing to do with whether or not you're a pro or how technically advanced you are.
But you do need to be "technically advanced" to "know whether or not it's malware". Otherwise, you end up installing nothing, and your device becomes equivalent to a first-generation iPhone running iOS 1, which runs only the included applications and web applications.
Why isn't it a function of the os to know what app is shoddy and what is not?
Because the user expects the device to make sure that the "smart" capability doesn't get in the way of the "phone" capability, especially for urgent calls.
You just have to choose background apps which are well written.
On Android, it's possible for the only applications that perform a given task to be applications that are not well written. For example, they might all use polling instead of pushing. On one of the more curated platforms, a user doesn't have to worry about several major categories of poorly-written applications because developers can't get the application onto a user's device unless it avoids the known poor practices.