Spammers have developed malware that is creating a botnet from Android mobile devices, the latest example of the explosive growth in attacks on Googles mobile operating system.
According to a Microsoft researcher, the malware is downloaded onto the smartphone via a rogue app, which then gets into users Yahoo free email accounts to send out spam. Microsoft engineer Terry Zink said he found spam samples coming from compromised Yahoo email accounts, but then noted that they were being sent from Android mobile devices.
Weve all heard the rumors, but this is the first time I have seen ita spammer has control of a botnet that lives on Android devices, Zink wrote in a blog post July 3. These devices log in to the users Yahoo Mail account and send spam. ¦ The messages all come from Yahoo Mail servers. They are all from compromised Yahoo accounts. They are sending all stock spam, the typical pump and dump variety that weve seen for years.
Looking at the IP addresses stamped in the headers of the emails, Zink was able to determine that the spam is being sent from a number of countries: Chile, Indonesia, Lebanon, Oman, the Philippines, Russia, Saudi Arabia, Thailand, Ukraine and Venezuela.
Zink and other security researchers believe that users of the compromised Android devices probably downloaded the malware when they downloaded an app not from the Google Play market, but from some other place on the Internet in hopes of avoiding having to pay. The countries that seem to be the source of the spam prove that out, according to the Microsoft engineer.
Ive written in the past that Android has the most malware compared to other smartphone platforms, but your odds of downloading and installing a malicious Android app is pretty low if you get it from the Android Marketplace, Zink wrote. But if you get it from some guy in a back alley on the Internet, the odds go way up. Ive also written that users in the developed world usually have better security practices and fewer malware infections than users in the developing world. Where are almost all of those countries in the list above? Mostly in the developing world.
I am betting that the users of those phones downloaded some malicious Android app in order to avoid paying for a legitimate version and they got more than they bargained for. Either that or they acquired a rogue Yahoo Mail app.
Chester Wisniewski, a senior security advisor at Sophos Lab, agreed.
It is likely that Android users are downloading Trojanized pirated copies of paid Android applications, Wisniewski said in a July 5 blog post. Android users should exercise caution when downloading applications for their devices and definitely avoid downloading pirated programs from unofficial sources. Google, Amazon and others may not be perfect at keeping malware off of their stores, but the risk increases dramatically outside of their ecosystems.
Google has worked to reduce the amount of malware, including developing its Bouncer program, which automatically scans for malware on apps in the Google Play marketplace.
However, given the open nature of Android and the large number of devices running the operating system, security experts are seeing a dramatic rise in the amount of malware that is being written for Android. In February, Juniper Networks officials reported that mobile malware more than doubled in 2011, growing by 155 percent across all platforms, which included Apple’s iOS, Research In Motion’s BlackBerry and Symbian.
However, malware targeting Android grew by 3,325 percent in the last seven months of 2011, and Android malware accounted for about 46.7 percent of unique malware samples that targeted mobile platforms, Juniper Networks found.
“Hackers are incented to target Android, because there are simply more Android devices as compared to the competition,” Daniel Hoffman, chief mobile security evangelist at Juniper, told eWEEK at the time.
That trend continued into 2012, according to security software firm McAfee, which is owned by Intel. In the first three months of the year, almost 7,000 Android threats were found, an increase of more than 1,200 percent from the same period in 2011, according to the McAfee report released in May. Most of these threats come from third-party app stores as opposed to Google Play, McAfee officials said.
