Slashdot Mirror
Android Malware Intercepts Text Messages, Forwards To Criminals
An anonymous reader writes "A new piece of Android malware has been discovered that can intercept your incoming text messages and forward them on to criminals. Once installed, the trojan can be used to steal sensitive messages for blackmailing purposes or more directly, codes which are used to confirm online banking transactions. The malware in question, detected as "Android.Pincer.2.origin" by Russian security firm Doctor Web, is the second iteration of the Android.Pincer family according to the company. Both threats spread as security certificates, meaning they must be deliberately installed onto an Android device by a careless user."
This'd only be newsworthy if it's installed via Google Play or another mainstream source. Otherwise, it's just stupid people paying the price for their ignorance.
From TFA,
Although Doctor Web doesnâ(TM)t say so, the good news here is that Pincer2 is not likely to be very prevalent. It has not been found on Google Play, where most Android users should be getting their apps, and appears to be meant for precise attacks, as opposed to being aimed at as many users as possible.
In short, this malware threat isnâ(TM)t one that you will likely be hit with, but it is an interesting example of how Android malware is evolving.
I thought the word careless was assumed to proceed user. I think that basically every slashdotter has been called to help some "careless" user who has 3 toolbars, 2 AV bloatwares, and countless other bits of crap that came along with all their downloads. Yet they will swear on a stack of bibles that "they never installed nothin' "
So any malware that depends on users being careless will be a huge success. The other key will be ease of use.
That being said, I generally stick with my brother's rule: "I wouldn't transmit it electronically if I wouldn't want it on the front page of a national newspaper." My niece texted me her password the other day; I pointed out the error of her ways.
I did just come up with an app for Google glasses. You send someone encrypted messages that are displayed on their screen as a QR code. Their glasses decrypt it temporarily while it is in view. The phone can't decrypt, the glasses don't store. Glasses can still get hacked though but at least you do not have a plaintext message store.
Kind of funny, isn't it...
Windows malware? Blame Microsoft.
Android malware? Blame the user.
A stupid user is a stupid user. Everyone is so quick to rush to the soapbox and preach how wonderful their platform of choice is and how awful the others are. I say rush to the box and preach how stupid people are. I say rush to the box and demand that basic computing security be taught to everyone just as proper hygiene and safe sex are. We do not need big brothers, we don't need walled gardens, we need people to know what the hell it is that they're doing with their electronics. Teach people to wash their damn hands, avoid disenfranchised Nigerians, stop opening random email attachments, and stop bloody installing apps that require access to your sensitive data.
Two of my imaginary friends reproduced once
The Apple App Store is not immune to malware, but does offer some level of protection and once a threat is spotted in the wild corrective action can be taken by the platform. I know a lot of people who went to droid and bragged about how "open" the platform was and not limited to any one store and that it was 1985 with Windows vs Mac again only this time with Android playing the Windows role. And I agreed with them. Android will become the windows of mobile devices. Complete with the viruses and malware windows users have come to know and love.
"The problem with socialism is eventually you run out of other people's money" - Thatcher.
16.9 million results.
But what can any iPhone trojan actually do? It's limited to sending contacts (and that only IF the user allows it at the time it tries to access the contacts, not on install). It can send the users location IF the user agrees to have the location accessed, at the time the app tries to access location (not on install). It can send your photos to them IF the user agrees to allow access to get to the photos... you get the picture.
What CAN'T it do? It can't access or send SMS messages. It can't access or send email messages (at least not without the user hitting send on the email). It can't make a phone call without the user saying "why yes I would love to dial that number now which is clearly displayed to me in full".
The issue is that because Android makes you agree to what it can do up front, most non-technical users will simply agree to anything, and then the app can really DO anything it likes to the user. There are safegaurds technical users can install; but they are exactly the people who do not need protection or help!
Android is a platform built for the pleasure of the technical elite, with a promise to non-technical users of being their gateway into the new world of mobile computing. But that is a lie; it's simply a PC you can put in your pocket that brings along for the ride every ill ever conceived of on a PC and more besides.
Android could go a long way by simply grantng permissions for things at the time the app wants them as iOS does; but even then the fundamental problem is that there are so many permissions that extend so deep into the system that it allows apps to do things like intercept SMS. You can't take those away now without technical users crying foul, but the cost to non-technical users is monstrous.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
If the platform is so safe, why does Apple have to review and sign every app before it's allowed to run?
Because trojans can use legal API's to do work, and defense in depth means that there is actually depth to your defense.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
What people miss is that iOS is MORE customizable for users by default in the ways that matter most. As you say, Skype having my contact list? Hell no!
Or Google Maps app having my location or contacts or anything whatsoever? Don't think so! All I have to do is say no, but I'm still using the app.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Lots of people leave Bluetooth enabled because they use it pretty often - car audio, headsets /speakerphones.
NFC I would think you'd leave enabled if you really used it for payments, otherwise it would be almost as slow as a normal credit card.
"There is more worth loving than we have strength to love." - Brian Jay Stanley