Slashdot Mirror
Massive Android Mobile Botnet Hijacking SMS Data
wiredmikey writes "A mobile botnet called MisoSMS is wreaking havoc on the Android platform, stealing personal SMS messages and exfiltrating them to attackers in China. Researchers at FireEye lifted the curtain off the threat on Monday, describing MisoSMS as 'one of the largest advanced mobile botnets to date' and warning that it is being used in more than 60 spyware campaigns. FireEye tracked the infections to Android devices in Korea and noted that the attackers are logging into command-and-controls in from Korea and mainland China, among other locations, to periodically read the stolen SMS messages. FireEye's research team discovered a total of 64 mobile botnet campaigns in the MisoSMS malware family and a command-and-control that comprises more than 450 unique malicious e-mail accounts."
Seriously, what is the "trickery" that gets one to download and install this "Google Vx" application, and how many Chinese people does it take to read our LOLs? Is someone out there texting their social security number or bank PIN?
Gently reply
"The mobile malware masquerades as an Android settings app used for administrative tasks. When executed, it secretly steals the user’s personal SMS messages and emails them to a command-and-control (CnC) infrastructure hosted in China,” the researchers reported."
The problem is with dumb users out there who just do not read the type of permissions required by apps they download versus the functionalities that it is supposed to give, that also without reading reviews and comments about it, such problems are bound to happen.
C&C exists because of irresponsible users, unfortunately, however care one can take, if the user themselves don't give much a damned about what they are installing and not giving a "grace period" to notice what each new app is doing for a period of time, we will keep having such problems.
Besides, that playstore thing, can't it have a peer review weightage on apps which helps flagging such stuffs and could potentially help in informing any users of such potential issues (granted, once you've been breached, you can't trust anything on that device.) Oh well, security keeps being a problem, so many years after, the problem is with the people not the software! +selven
Heh you Android guys are funny. If that was an article about Microsoft Windows, you'd be all over the place spewing end of days stuff :))))))
An amazing leap there eh?
It also seems you're pretty far off the mark. As people read the articles, they discovered there's much about how the botnet works and not so much about how the infection gets in there except to say "the malware pretends to be something useful" or in other words, as a trojan horse.
And the short concensus of it is "if you're stupid enough to install these sketchy apps, you deserve what's coming to you." That said, the articles never exactly stated how wide spread this is. I suspect it's limited largely to China and Korea as I suspect those locations might, in some way, control what apps get loaded to their devices. In any case, I don't think it's global in any way.
And so far, all Android malware is acquired through stupid behavior which is not strongly blocked by Android though each user pretty much has to manually allow installing apps from locations other than Google.
What will it look like if I ever go into one of those mobile OSes from the security standpoint compared to less mobille OSes? I haven't touched mobile OSes even remotely yet. I understand the apps ecosystem might cause problems not directly linked to the OS but still, overall?
Everything I write is lies, read between the lines.
For all the exaggerated scary words used like "one of the largest", "more than 60 campaigns" etc, there was not a single solid data point about the actual devices infected. Not even a ball park number - like whether it is tens, thousands or millions of devices.
Makes me suspect the claims.
I'm much more funny, interesting and insightful than the moderators think
Seriously, what is the "trickery" that gets one to download and install this "Google Vx" application
Flashlight App.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I can't find any information about where this was downloaded from. It's not on the Play Store (or at least, not anymore), so where were people downloading it from?
Summation 2
Download your apps from a reputable store and exercise some common sense. I wouldn't be surprised if this infection was because idiots were downloading warez from some dubious app store.
When was the last "Massive iOS Mobile Botnet Hijacking SMS Data" headline?
When was the last maximum security prisoner getting run over by a bus headline? Sometimes freedom has its own risks, which includes idiots making poor decisions over where to get their software from. Does that mean everyone should be locked up in a cage to prevent that from happening?
> No kidding. I had to look through dozens of "flashlight" apps
> to find one that didn't want my calendar, SMS, internet access,
> and GPS.
F-Droid is your friend.
As always, FOSS means you don't have to put up with the bullshit.
F-Droid build all apps they ship from source, including some sort
of grep filter on permissions to catch (and then remove) any code
which is not in the user's best interest, or at minimum flag and
explain the issue in detail to let you decide for yourself.
Otherwise-good apps with flagrant ad-ware or cripple-ware in it
simply gets patched.
~.~
I'm a peripheral visionary.
> Is there any easy to use firewall configs to block/allow by country?
That very much depends on your definition of easy.
Netfilter is there. Some phones have iptables pre-installed, so on those phones you'd blacklist or whitelist list exactly the same as any other Linux distribution. That's easy for me, it would be hard for a lot of people.
Other phones don't have iptables installed so you'd need to copy the binary over to the phone.
At minimum, you'll need root access on the device.
The Android permission system blows goats. It's not just the "all or nothing" approach to app acceptance. It runs deeper. It's also the app store itself, where I can't restrict (or prioritize) search results based on permissions demanded.
Using aSpotCat, under android.permission-group.PERSONAL_INFO I've got AdService, Chrome, Firefox, Gmail, Google Play, Pebble, and RunKeeper. I've had to bail on the installation of close to fifty apps to keep this list this short.
Basically the Android security model deters me from actually installing software, to the point where I no longer regard it as a platform.
This xmas between an Android tablet and an eReader, I'm likely to get an eReader (Kobo here in Canada), which is not a platform either, and doesn't play one on TV.
I was reading reviews that commented that a Kobo Aura is about the price of a servicable, entry level tablet from Walmart. Several of the reviewers commented "you might as well get the full Android platform for the price". What platform? Android is mainly a platform for sharing far more about myself than I wish to divulge with strangers I don't even know. Whatever information is gleaned will never be under my control ever again: it will almost certainly be amalgamated from one low-life to another ad nausium.
I'd be quite happy if not a single vendor knew my location ever, who wasn't providing me with a map for my own purposes (such as RunKeeper). If they need to know, I'll tell them. Yet 90% of Android applications demand to hoover this up and the Google play store provides no mechanism to put these applications on a personal shit list, so that better-behaved applications float to the top of the candidate list.
Android: Death by a thousand peeping toms. Where's well-behaved Waldo? Crushed by the throng. Eventually Diogenes tires of visiting the Turkish baazar and begins to subsist on juniper berries.
Why go through all the trouble just to know my wife asked me to pick up milk?
If it ain't broke, don't fix it.
I understand what you're saying. However, compare this "ridiculously broad" system to almost anything else, such as your Windows desktop. On Windows, applications have 100% permissions to do whatever they want on your computer. The user is either admin or not admin, two choices only.
It seems to me Android's system is a giant leap forward, although it's imperfect. You have very fine grained control in Linux through SELinux. Some people might prefer that level of control, but that level of detailed control can also be unwield.
* I haven't used Windows 8. If Windows 8 finally has a security model even as powerful as "chmod g+r" from 1972 Unix please forgive my lack of knowledge about Microsoft's latest silliness.
I assume that's a strange way of spelling 'sending'
That said I think it is vital that Android should allow me to withhold a permission, exchange the permission for a lesser one (e.g. fine grained location for a dummy location), or receive a prompt. I also think that Google should weight apps in the store by the risk they pose which could be a weighting based on the reputation of the seller, the app's rating and the permissions it asks for. Apps would be inclined to ask for less permissions or farm those permissions out into an optional and auxiliary app if they knew it improved their search rankings.
"MisoSMS is wreaking havoc on the Android platform"
This is BS, how does this malware get on to the device in the first place, does it require user action or can it install silently and root the device.
When was the last "Massive iOS Mobile Botnet Hijacking SMS Data" headline?
When was the last maximum security prisoner getting run over by a bus headline? Sometimes freedom has its own risks, which includes idiots making poor decisions over where to get their software from. Does that mean everyone should be locked up in a cage to prevent that from happening?
No, not at all, but there are parts of this story that expose one of the weaknesses of the Android permissions model; namely that an app requests a set of permissions (that are overly broad to cut down on the number of permissions groups) and you have to either accept or deny those permissions wholesale.
Because the people who download dodgy apps and sideload them, then click past the permissions list without even looking at it would selectively disable the permissions they didn't really want to grant?
The permissions problem you refer to is a really difficult one to solve. Oh, it could be solved for you, by giving you the ability to selectively disable permissions (which, BTW, you can actually do with a small amount of one-time effort), but face it, less than 1% of Android users would carefully vet and individually select the permissions. Probably much less than 1%.
Then there's also the problem that individual permission selection would just cause app developers to test to see if they got all the permissions they wanted, and refuse to function at all if they didn't. Google could respond by trying to make it appear that the apps did get permission, perhaps by serving up fake data, but that would just create an arms race between app developers and Google, and apps have a much shorter release cycle. In fact, for power users the status quo is probably better, because they can root their phones and use an app to selectively disable permissions, but there aren't enough of them (far less than 1%) to motivate app developers to try to work around it.
I don't know what the solution is, but I don't think that's it. I lean more towards finding ways, at least in the official app store, to shame apps that request broader permissions than they should. Maybe Google should develop some sort of a "risk rating", based on the permissions requested and the trustworthiness of the publisher and tag every app in the store with it, perhaps even adding an additional warning dialog if the risk is over some threshold, and probably artificially lowering "risky" apps in the search results. Of course, the really problematic apps aren't on the Play store, and adding an additional warning on an app that a user has already chosen to get from some dodgy site is unlikely to help. But Google might be able to dissuade publishers of apps on Play from requesting more permissions than absolutely required.
(Disclaimer: I work for Google, but not on Android. My relationship with Android is that of a user.)
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
You can't download other app stores from Google Play because of the "non-compete" provision of the developer agreement. If you don't trust the F-Droid app, you can always download Eclipse and recompile it yourself. But a problem with F-Droid is an inherent limit in funding development of Free games. Even if a game's engine is free, it'll get blocked with "anti-features" if it recommends installing non-free mission packs.
Then the app developer can just hide the malicious functionality in a game. Users of free software repositories are already used to going to the non-free repositories for games for several reasons.
What "reputable store" happens to be available to people who live in the People's Republic of China, which doesn't appear to have Google Play or Amazon?
Increasingly, major webmail and social networking providers have been using access to a particular mobile phone number's SMS inbox as a second factor in 2-factor authentication.
This "arm race" wouldn't ever occur. Apple and MS are considerably more hostile towards developers and the developers just accept it. Making the OS, Hardware and Store owner mad at you is not a recipe for success if you want to be an app developer.
the attackers are logging into command-and-controls in from Korea and mainland China, among other locations, to periodically read the stolen SMS messages.
Rumor has it that they are paying James Earl Jones and Malcom McDowell to read those stolen SMS messages out loud.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
This "arm race" wouldn't ever occur. Apple and MS are considerably more hostile towards developers and the developers just accept it. Making the OS, Hardware and Store owner mad at you is not a recipe for success if you want to be an app developer.
I suppose Google could institute a policy of banning apps that try to circumvent ad-hoc user permission restrictions. Yeah, that would cut the arms race off at the knees. Good point.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Android's being infested faster than Windows ever was in the same timeframe of existence.
There are far more established malicious software developers making money than when windows first launched so I would not be surprised if that is true. Regardless of how secure your OS is once it becomes the most common consumer platform then that is where the money is, it is a target, and someone will find a way to make that money even if it is playing on the inexperience and stupidity of the average user.
Up until this point the lamp has been the biggest area where linux is used and they are usually managed by more experienced {more experienced than a regular consumer} admins. I imagine that the quality of admin increases as the monetary reward for an exploited lamp increases making it more difficult to turn some easy bucks. Making it a not so promising target although it is not unheard of for an exploit to happen.
The problem is in China, Google is not allowed, so Android phones do NOT ship with Google Play. Instead they ship with one or dozens of official Chinese Android app stores, which have poor quality control, often contain pirated apps (submitted by other people), and yes, tons of malware. (It's also a failure of competition as each store competes for business, so they end up wanting people to post as many apps as possible so they get used the most).
Asking the user about security is a big no-no these days, because the user will pick the option that gets them to their goal to the quickest. Or, put another way, users will pick dancing pigs over security any day. It's a failure of security policy to not recognize this (think about all the times people workaround IT security restrictions just to get their job done).
The Android permission system is basically that policy - pop up that huge list of permissions, the user's eyes glaze over and they want to pick the option that gets them "Candy Crush With Everything For Free" the quickest. Well geez, what are they going to do?
Same goes for any popular app - recommend them a cool app and they probably won't look at the permission list at all.
With this in mind, on iOS, there's no API to get at the SMS directly - you need to rely on OS flaws to do it. Even sending an SMS requires switching to the iMessages app - no app can send an SMS directly unless they implement SMS functionality within themselves (which means they can't use the cell network SMS facilities).
In that case, Apple simply makes it impossible for the user to "do the wrong thing" under the assumption that 99% of the time, any app wanting to do this will use it for evil. Sure it keeps innovative SMS apps off the App Store, but developers it turns out that for every innovative SMS app, there will be hundreds, if not thousands of other developers who would abuse the privilege. (Especially for say, advertising).
.
http://selinuxproject.org/page/SEAndroid
"Security Enhancements for Android (SE for Android) is a project to identify and address critical gaps in the security of Android. Initially, the project is enabling the use of SELinux in Android in order to limit the damage that can be done by flawed or malicious apps and in order to enforce separation guarantees between apps. However, the scope of the project is not limited to SELinux."
In fact its part of the latest Android distributions (Android 4.3+) but its not generally enabled by default yet. Eventually we should be able to lock down the device to prevent all kinds of malware, but unfortunately it doesn't block users from being stupid and installing apps from the more seedy places. Chances are if you install a hacked app you'll just grant it all kinds of permissions that you shouldn't. It can't fix 'stupid'.
Google, i dare you, i really dare you, make android by default, whitelist countries IP addresses. So that I can choose, EU only, or Asia only, except china/korea. Or USA only ip addresses. Yeah its drastic, but 99% of users wont access websites outside usa, or their home country or two.
Do you have citations or experience to back that claim up? I live in Illinois, my web site is in Canada. I had a pretty popular Quake site from 1998 to 2003 that used the same host as I'm using now. My traffic came from all over the world, and actually less than half of the traffic I got was from the US.
So you're Canadian and you want to block US sites? Mine still shows up because it's hosted in Canada.
What I'd like to have is the ability to search by root domain, e.g. "semiconductors site:*.edu" or "health site:*.gov". I often want results only from an edu domain, but there's no way I know of to do that.
Free Martian Whores!
Interesting (and well-stated) points.
However, I don't think allowing users to control individual permissions will fix it. Users will just continue authorizing the kitchen sink. If some of them start exercising more control over specific permissions, app developers will simply respond by refusing to show the dancing pigs if SMS isn't actually working.
And I don't think shutting off the APIs entirely is an acceptable solution, even if it arguably works for Apple.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Why not use app ops? remove all permissions you do not want an app to have. We should be telling apps what they are allowed to do not the other way around!
So I think apps would be foolish to go down that road. Once the cat was out of the bag that they were screwing their apps on purpose, they'd be downranked to oblivion. I think most likely that most apps wouldn't care on the general principle that the power of the default is a powerful thing.
That said, this is all orthogonal to this story. Android's security clearly needs improvement but when you have a bunch of people downloading their apps from a tainted source it wouldn't matter if it got finegrained controls or not.
With this in mind, on iOS, there's no API to get at the SMS directly - you need to rely on OS flaws to do it. Even sending an SMS requires switching to the iMessages app - no app can send an SMS directly unless they implement SMS functionality within themselves (which means they can't use the cell network SMS facilities).
Conversely, Android does allow 3rd party apps to swap out core parts of the experience and it has lead to some highly innovative products. Apps like Viber integrate VOIP into the standard dialler. There are countless SMS apps which add stuff like emoticons & IM functionality (even Google Hangouts is one). There are numerous desktop replacements, many which provide a modern launcher to older devices, or augment the experience in interesting ways.
Yes there is malware lurking around on the fringes, but that's the price of freedom. Google has a responsibility to squash it whenever it rears its ugly head in the store and I assume they're pretty good at it. Consumers have a responsibility to read the permissions and favour apps which have no earthly reason to be asking permission to do things which could be harmful.
I don't see they can do much for 3rd party stores. It's not Google's job to police Amazon's appstore, or Opera's, or the gazillion stores in China. That's their job. There is nothing to stop some Chinese entrepreneur launching a curated store with trusted apps from trusted sources. Maybe it already exists and some fools still choose to ignore it for another site where everything is free. More fool them.