Attacks/Breaches
7/19/2012
08:46 AM
50%
50%

Android Attackers Launch Fake App Market

Malicious apps include a fake version of Skype that surreptitiously sends text messages to premium-rate numbers, racking up charges to the user and revenue for the cybercriminals.

Having a difficult time distributing your malicious smartphone apps? Then why not just create an entire fake app store to peddle your wares?

In fact, that appears to be the strategy employed by the creator of "myadroidmaklet.net," a third-party app market that purports to offer more than 50 apps for free download, including Adobe Flash Player, Angry Birds Rio, Google Maps, Mozilla Firefox, Need for Speed Hot Pursuit, Opera, Skype, and World of Goo. But in fact, all of these apps are really a Trojan app--malware--in disguise.

Microsoft has dubbed the underlying Trojan Android app as SMSFakeSky, and noted that it's designed to target Russian-speaking users. "It poses as a legitimate application, so when you try to install the Trojan, it may ask you for permissions to run," according to Microsoft's malware analysis. Notably, the app will request permission to read a user's sent and received SMS and MMS messages, to see the user's location, have full Internet access capabilities, modify and delete the contents of removable storage, and to gather all information related to phone calls. The app also typically requests permission to download further required software, such as Adobe Flash Player, although even this installation will be just another version of the Trojan app in disguise.

[ Even legit mobile apps can carry risks. See Free Android Apps Have Privacy Cost. ]

Android permission requests are meant to give Android users pause, prompting them to ask: "Is the app that wants full Internet access legitimate, or really malware?" But if attackers can trick a user via a social-engineering attack into downloading a "Skype" app that they think is real, then it's likely that they'll grant the malicious app whatever permissions it requests. In addition, the number of different permissions requested is no giveaway, given the "excessive permissions" requested by many legitimate Android apps.

Once the disguised SMSFakeSky receives those permissions, it executes. "When it runs, the Trojan displays a fake progress bar, so as to appear as though it is downloading an app to your mobile device," according to Microsoft. "It then displays a URL to a supposed statement of agreement, but you cannot access this link. When you click the 'Agree' button, the Trojan will send multiple SMS messages to premium numbers at your expense."

The malware's use of prompts helps hide what it's really doing. "The deception behind the UI [user interface] controls is difficult for users to detect. It is likely that the malicious activity would cause mobile charges before the victim notices it, and this creates a large incentive for cybercriminals to continue perpetrating this fraud," said a blog post from Methusela Cebrian Ferrer at the Microsoft Malware Protection Center.

SMSFakeSky is far from the first piece of malware designed to make Russian phones send messages to premium-rate SMS numbers, thus draining funds from the accounts tied to infected smartphones, and delivering the money to attackers. The prevalence of such malware reflects a lack of legislation holding telecommunications providers accountable for attacks that make use of premium numbers. Indeed, Russia and many other Eastern European countries allow anyone to anonymously rent a premium-rate number, and the labyrinthian relationship between telecommunications companies and resellers who can lease such numbers makes tracing even providers of such numbers difficult.

Beyond setting up fake storefronts such as myadroidmaklet.net, another up-and-coming Android scam, according to Microsoft, is the use of paid archives that contain malware. "These are less aggressive by nature as they don't infect the system. Instead, they use a more cunning way to trick users into giving them money without using scare tactics--by getting them to pay for software that's otherwise free, or for pirated copies of paid software," according to Microsoft researchers Sergey Chernyshev and Daniel Chipiristeanu. They plan to detail their research into paid archives, including the use of automated fake-archive generation tools, as well as a breakdown of "how the money is earned and distributed by the bad guys," in September 2012 at the VB2012 conference in Dallas.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2001-1594
Published: 2015-08-04
GE Healthcare eNTEGRA P&R has a password of (1) entegra for the entegra user, (2) passme for the super user of the Polestar/Polestar-i Starlink 4 upgrade, (3) 0 for the entegra user of the Codonics printer FTP service, (4) eNTEGRA for the eNTEGRA P&R user account, (5) insite for the WinVNC Login, an...

CVE-2002-2445
Published: 2015-08-04
GE Healthcare Millennium MG, NC, and MyoSIGHT has a default password of (1) root.genie for the root user, (2) "service." for the service user, (3) admin.genie for the admin user, (4) reboot for the reboot user, and (5) shutdown for the shutdwon user, which has unspecified impact and attack vectors.

CVE-2002-2446
Published: 2015-08-04
GE Healthcare Millennium MG, NC, and MyoSIGHT has a password of insite.genieacq for the insite account that cannot be changed without disabling product functionality for remote InSite support, which has unspecified impact and attack vectors.

CVE-2003-1603
Published: 2015-08-04
GE Healthcare Discovery VH has a default password of (1) interfile for the ftpclient user of the Interfile server or (2) "2" for the LOCAL user of the FTP server for the Codonics printer, which has unspecified impact and attack vectors.

CVE-2004-2777
Published: 2015-08-04
GE Healthcare Centricity Image Vault 3.x has a password of (1) gemnet for the administrator account, (2) webadmin for the webadmin administrator account of the ASACA DVD library, (3) an empty value for the gemsservice account of the Ultrasound Database, and possibly (4) gemnet2002 for the gemnet2002...

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!