"SMSZombie" Malware Infects 500,000 Android Users In China 116
wiredmikey writes "Researchers have recently discovered a new sophisticated and resilient mobile threat targeting Android phones that is said to have infected about 500,000 devices, mainly in China. Called 'SMSZombie,' the malware is stubborn and hard to remove, but users outside of China have little to worry about with this latest discovery. The prime function of the mobile malware is to exploit a vulnerability in the mobile payment system used by China Mobile, making it of little value to the fraudsters outside of China. The malware takes advantage of a vulnerability in the China Mobile SMS Payment process to generate unauthorized payments to premium service providers, and can also remotely control the infected device. It has been spread via wallpaper apps that sport provocative titles and nude photos, and can only be removed using a lengthy process beyond the skills of a typical android user."
Re:Obvious scam (Score:5, Interesting)
You would be surprised how easy it would be to get stung by this by an average user [1].
A couple months ago, I was browsing for a couple games. Looked at the game, and it demanded every right under the sun. Of course, it didn't get the second install click.
However, it was a game with an icon that was the logo for a popular game show, so it looked "legit" enough to a user. Most Android users are not the top tier IT people who know exactly what an app should and should not be doing. They tend to see an app, tap it, and go from there.
All and all, the Android permissions are working fine. The app couldn't do much to hide in the system, so someone removing the device admin and then the app resulted in a cleanup. Had the app had root, it could insert itself into a lot more places.
The problem is that whomever is the curator of the app store [2] in question. There really needs to be at least two tiers with some warning about entering into Mordor for the second tier. Android needs to have default stores like Amazon's that apps are vetted to a strict code before they hit the store. Not just checked with a scanner like the Bouncer, but put up to a higher tier of rules than the free-for-all of the present Google Play store. The reason for the higher standard is to minimize the "developer banned at 9:00, app is back in the store at 10:00 under a different name", which was not uncommon.
Android is great (and it can be argued that the OS is more secure than iOS when compared side to side [3]); it just needs a beefy gatekeeper enforcing a proper dress code. iOS's security would be significantly weakened without an active gatekeeper, and Apple has done a good job at keeping the nasties out of the Apple ecosystem.
[1]: The Dancing Bunnies "hole" has defeated many security systems.
[2]: I wasn't sure if it is Google or what, so using "app store" as a generic term. App Store would likely mean Apple's offering.
[3]: iOS depends on the "jail" system completely. A rooted Android device does not lessen any security, unless the user decides to let an app through via "Superuser" that shouldn't have root.
Re:"Walled garden"? (Score:5, Interesting)
Amazon apparently still needs to learn this, given the recent Kindle Touch remote root exploit [makeuseof.com].
Re:"Walled garden"? (Score:4, Interesting)
I've seen a $200 box with a patent sell for $50,000+ because the "value" was $50,000 plus, but the patent was obvious and not novel (It was essentially signal cancellation for an expensive piece of communications gear, with court cases about it because two companies patented the same thing at the same time, both valid because the patent office isn't technical enough and the filing periods overlapped so neither was granted before the other was filed, so not previous art for the other).
Re:"Walled garden"? (Score:3, Interesting)
From the article:
"According to TrustGo, the malware is being spread through online forums and has been found in several packages on China’s largest mobile app marketplace, GFan"
Better revise your "attack vector" description.
Most Android users only use Google Play Store, which not only is not known to be affected by this malware, it also has the ability to remove it from users' phones after the fact - so you're wrong there too.
You even admitted there is malware for 'jailbroken' iphones, which would be a more direct comparison here.
Android likely has more malware potential, but this specific attack isn't a problem for those who stick with Google Play Store. Those who use alternative stores should understand the risks (or in fact, anyone using technology such as the internet should understand the risks).
Sophisticated? (Score:2, Interesting)
The "Wallpaper" trojan has to get administrative priviledges from the user. Social engineering trick.
Then it downloads the malicious code. Not impressed.
Finally, it monitors keystrokes. Key logger anyone?
Is it just me, or does the company (TrustGo) that called this malware "Sophisticated" have an ulterior motive? Care to purchase a mobile security product?
http://www.trustgo.com/en/