English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Android SMS Trojan Now Being Delivered via SEO Techniques

Denis
Kaspersky Lab Expert
Posted September 08, 17:39  GMT
Tags: Mobile Malware, Search Engines
0.3
 

Android users searching for pornography on their smart phones could be in for a costly surprise.

During the course of researching the origin for the first SMS Trojan for Android devices, I found a new Android package masquerading as a porn media player but which instead sends SMS messages to premium rate numbers.

The SMS messages cost $6 each and are sent silently in the background without the user's knowledge.

The latest Android malware (detected as Trojan-SMS.AndroidOS.FakePlayer.b) is being distributed via clever search engine optimization (SEO) techniques, a clear sign that cyber-criminals are making every effort to infect mobile devices. The use of SEO is a significant development that confirms our belief that mobile malware - especially on Android devices - is a potentially lucrative business for malicious hackers.

The code in the latest variant is similar to the first version and I'm pretty sure the same person (or group) is involved in creating and distributing this Trojan. It is currently targeting Android users in Russia.

The fake porn player does not have a user interface. Once installed, it simply drops an icon (an adult-themed photograph) on the smart phone's screen and starts sending premium SMS messages without the user's knowledge whenever the app is launched.

The malware is not available in the official Android app store. It is being distributed via Web sites but, with the search engine optimization techniques being used, there is a likelihood this is infecting a lot of users.

Like all Android apps, the user is prompted to manually install and allow the application to access certain parts of the operating system. This should serve as an immediate warning, especially since media players should not require access and permission to send SMS messages.

As I said in my previous blog entry on this topic, Android users should pay close attention to the services an application requests to access. Automatically permitting a new application to access every service it requests means you could end up with malicious or unwanted applications doing all sorts of things without requesting any additional confirmation. And you won’t know anything about it.


2 comments

Oldest first
Threaded view
 

Costin Raiu

2010 Sep 09, 12:07
2
 

Android malware

As usual, the malware equation seems to work:

Open environment + widespread + money to make = new malware

Reply    

Aravind vijayan

2011 Jan 01, 20:27
0
 

Geinimi

can you say something about geinimi..thanx in advance..

Reply    
If you would like to comment on this article you must first
login


Bookmark and Share
Share

Analysis

Blog