Android Trojan delivered via Facebook "Suggested Posts"
Posted on 25.02.2014
Researchers have uncovered a potentially massive attack on Android users. This highly elaborate ploy originates on Facebook, where cyber-criminals advertise a series of apps.

When users access Facebook from their Android mobile device, they will see different messages under the title "Suggested Post" advertising WhatsApp tips like: “Want to know how to see your contacts’ chats on WhatsApp?” or “Want to hide your WhatsApp connection status?”.

If the intended victim clicks on any of these ads, they are redirected to a fake version of Google Play, the Android app store. The user, thinking that this is the genuine site, downloads the free app, which is really a Trojan that subscribes users to a premium-rate SMS service without their knowledge.

“In this attack, cyber-criminals have taken advantage of Facebook’s targeted advertising options. In this case, the ad is only shown to Spanish Facebook users who are accessing the social network from an Android mobile device. We carried out tests using the same account from a PC, an iPad, an iPhone and Android and the ads were only displayed when using the Google operating system”, said Luis Corrons, Technical Director of PandaLabs at Panda Security.

The Trojan checks all inbound messages received on the device and if the sender is the premium-rate SMS service, the message is intercepted and deleted so the user is unaware.

Yet this technique doesn’t work with the latest 4.4 (KitKat) version of Android, so the creators have come up with an ingenious trick to overcome this: when the message is received, the phone volume is muted for two seconds and the inbound message is marked as read. The app includes an SMS counter, so when the first message is received from the premium-rate service, it reads it to get the confirmation PIN and registers the user on the corresponding website to activate the premium-rate SMS service.

The Trojan also deletes any messages sent from the number 22365, another number associated with an alternative premium-rate SMS services, although from a company apparently unrelated to this attack. All signs would suggest that this is designed to protect against a specific competitor: if another Trojan tried to register to an SMS service it wouldn’t be able to access the confirmation message and consequently it couldn’t access the PIN and activate the service.

The cyber-criminals are not just using WhatsApp as bait, but also any topic that could attract users: ‘amazing videos’, Candy Crush tricks, Angry Birds tricks, etc.

Panda Security has contacted Facebook to warn of this malicious advertising campaign.





Spotlight

What can we learn from the top 10 biggest data breaches?

Posted on 21 August 2014.  |  Here's a list of the top 10 biggest data breaches of the last five years. It identifies the cause of each breach as well as the resulting financial and reputation damage suffered by each company.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Aug 22nd
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //