SMS Trojan detected for smartphones running Android

[wozofoz]

Hi, I couldn't find any mention of this here so.....

9th August 2010 (Australia time)

First SMS Trojan detected for smartphones running Android

Kaspersky Lab, a leading developer of secure content management solutions, announces that the first malicious program classified as a Trojan-SMS has been detected for smartphones running on Google’s Android operating system. Named Trojan-SMS.AndroidOS.FakePlayer.a, it has already infected a number of mobile devices.

The new malicious program penetrates smartphones running Android in the guise of a harmless media player application. Users are prompted to install a file of just over 13 KB with the standard Android extension .APK. Once installed on the phone, the Trojan uses the system to begin sending SMSs to premium rate numbers without the owner’s knowledge or consent, resulting in money passing from a user’s account to that of the cybercriminals.

Full information @ Kaspersky Lab News

All the best, woz of oz

[lelisa13p]

Thanks for posting this, woz. I read something about this last nite. Makes a girl wish there was a way to "reverse infect" the criminals.

[lorsban]

Thanks for posting!

Good thing it needs your confirmation to install itself.

[Hook]

Same rules as always-- don't open or download anything from an unknown source, whether email or SMS. In fact, if you don't know the source of a comunication, delete it without even opening the message. If it is someone legit, they'll find another way to communicate.

[Drillbit]

First, it only works in Russia.

Second, said app is not in the Android Market.

Still one has to read the Permissions and be a little smart when installing any app. Same with PCs.

[Mickeylittle]

I'm new to Android, coming from an iPhone last night. I noticed in the Market Place there are Antivirus apps. Should I install one of them? I don't expect to get suspicious emails but I do expect to be trying quite a few 3rd party apps from the Market Place.
Thanks

[Hook]

Can't hurt, I have Norton and Lookout (the latter for its ability to Geo-locate a lost phone and place its location on Google Maps on your computer). However, to be honest, I suspect that if you are getting apps from the market, especially from known developers with high ratings, you may not need them. However, at least on my Nexus One, there isn't any performance hit. No harm in being cautious. So far they are free (I'm expecting Norton to cost when it comes out of beta, but who knows).

[questionfear]

I also find reading the comments to be helpful. People are pretty quick to note anything suspicious (like, "Why does this game need access to my contacts?").

And I've opted not to install games that want anything other than internet access and the ability to keep the screen on. Unless it's from a trusted developer or has social network capabilities, a card game doesn't need access to my email, phone, or contacts.

[Varjak]

QF, why would most games even need internet access? To periodically query for updates? I'd just as soon give that up to have the game sequestered on my device.

For me, the risk of malware on a smartphone is almost worse than on a desktop. For many (including me), there's probably more sensitive info on my phone/PDA than on my desktops/laptops. I'm Luddite enough that I don't do certain things on my PC's (like internet banking) just so I can avoid any problems like ID theft.

[questionfear]

QF, why would most games even need internet access? To periodically query for updates? I'd just as soon give that up to have the game sequestered on my device.

For me, the risk of malware on a smartphone is almost worse than on a desktop. For many (including me), there's probably more sensitive info on my phone/PDA than on my desktops/laptops. I'm Luddite enough that I don't do certain things on my PC's (like internet banking) just so I can avoid any problems like ID theft.

Sorry I should have been more clear. Some games (like a mini-golf game that I am horribly addicted to) have universal leaderboards and online competition options where you can compare your results to other players, challenge other players to a tournament, etc. If a game DOES NOT offer that, it shouldn't have internet access. Most games tell you up front why they need the access, so I just look for the info or uninstall if I'm not happy.