Spammers have started using Android botnets, researchers say
- 05 July, 2012 17:38
- Comments
A new wave of pharmacy, penny stock and e-card spam emails are being sent by an Android botnet, according to security researchers from Microsoft and antivirus firm Sophos.
Terry Zink, program manager for Microsoft Forefront Online Security, was the first to report about the spam messages. They all come from Yahoo's email servers and they are sent from Android devices, he said in a blog post on Tuesday.
"We've all heard the rumors, but this is the first time I have seen it -- a spammer has control of a botnet that lives on Android devices," Zink said. "These devices login to the user's Yahoo Mail account and send spam."
Security researchers from Sophos have also analyzed the spam messages, which advertise generic meds, penny stocks and e-cards, and have arrived at the same conclusion. "The messages appear to originate from compromised Google Android smartphones or tablets," Sophos senior security advisor Chester Wisniewski said in a blog post on Thursday.
The researchers don't have a copy of the Android malware responsible for this spam campaign, but there is indirect evidence that suggests that the emails are being sent from Android devices.
The value of the Message-ID field in the email headers mentions "androidMobile" and the messages themselves end with "sent from Yahoo! Mail on Android," Zink said.
In addition, the originating IP addresses, which are included in the email headers, are assigned to mobile carriers, Wisniewski said on Twitter.
Based on the IP addresses seen so far, the infected devices are located in countries like Ukraine, Russia, Chile, Argentina, Venezuela, Indonesia, Thailand, Philippines, Lebanon, Oman and Saudi Arabia.
It's not clear how these devices got infected, but the likely scenario is that their owners downloaded pirated copies of legitimate commercial apps and those copies also contained malware, Wisniewski said.
The immediate consequence for victims could be a higher mobile phone bill. Sending thousands of spam messages can generate a lot of mobile data traffic and mobile data is not cheap in most countries.
Android Trojan apps have been used in the past to steal data, send SMS messages to premium-rate numbers or display unwanted advertisements. However, they've never been used to send spam before.
"If confirmed, the discovery of an Android botnet capable of sending spam will mark a milestone: at the moment there are more than one billion smartphones activated in the world and most of them are always connected to the Internet at all times, so they can pump up spam 24/7," said Bogdan Botezatu, a senior e-threat analyst at antivirus vendor BitDefender, via email.
BitDefender researchers are analyzing a malware sample that they believe might be connected to these spam campaigns. However, the company can't confirm the botnet's existence for now, Botezatu said.
Not all security researchers are convinced by the evidence found so far. "Currently we can't confirm - or deny - the existence of this supposed Android botnet," said Denis Maslennikov, a senior malware analyst at security firm Kaspersky Lab, via email. "The evidence put forward to claim that this is an Android botnet is based on data which is easily spoofed/forged."
Recommended
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
- Bookmark this page
- Share this article
- Got more on this story? Email CIO
- Follow CIO on twitter
-
Why change management doesn’t work
-
Larry Page wants to see your medical records
-
Dual-Persona Smartphones Not a BYOD Panacea
-
After two-year hiatus, EFF accepts bitcoin donations again
-
CIOs struggle to deliver timely mobile business apps: survey
-
Detecting APT Activity with Network Traffic Analysis
Today’s successful targeted attacks use a combination of social engineering, malware, and backdoor activities. This research paper will discuss how advanced detection techniques can be used to identify malware command-and control (C&C) communications related to these attacks, illustrating how even the most high-profile and successful attacks of the past few years could have been discovered. -
CSO Spotlight: Security-as-a-Service Gaining Popularity
Organizations that are looking for security features including identity management, encryption and access control — and at the same time want to take advantage of the cost and flexibility benefits of the cloud —might check into security-as-a-service offerings available now from several vendors. Download now to find out more. -
Leading Through Connections – Insights from the Global Chief Executive Officer Study
IBM’s 2012 Global CEO study follows face-to-face discussions with more than 1,700 CEOs and senior public sector leaders from around the globe. The findings examine how CEOs are responding to the complexity of increasingly interconnected organisations, markets, societies and governments. For example, almost one-quarter of CEOs say their organisations operate below par in terms of driving value from data. CEOs have expressed frustration about their inability to capitalise on available information. This is because: “The time available to capture, interpret and act on information is getting shorter and shorter.” CEO, Chemicals and Petroleum, United States Given the need for deeper business insight, the best performing organisations are more adept at converting complex data into insights, and insights into action. Download Entire Report Now.
Get exclusive access to Invitation only events CIO, reports & analysis. 
