Phone users hit by new type of hack

Another day, another security threat - this one a neat twist on mobile phone scams. Security vendor Kaspersky Lab has found that hackers have discovered a way to text money out of users' phones. The problem has been found in Indonesian phones although it's a problem that could have global implications.

Kaspersky has found a Trojan horse that takes advantage of a feature that lets mobile-phone users send SMS text messages to transfer money in their mobile accounts from one phone to another.

The software is a variant of the Trojan-SMS.Python.Flocker malware, originally written by Russian fraudsters. This software had been used to sign unwitting victims up for expensive mobile services such as ringtones, presumably with the program's authors getting a healthy kickback. "It seems like some Indonesian guys had a look at this stuff and thought, 'Hey, we could do this in Indonesia,'" said Roel Schouwenberg, an anti-virus researcher with Kaspersky.

For the attack to work, the victim must first be tricked into downloading the Python.Flocker program onto a Symbian-based mobile phone. Once installed, the software uses a feature available to Indonesian mobile-phone users that lets them send a short SMS message to another subscriber that transfers the money into their account. The Trojan transfers the equivalent of between US$0.45 (32p) and $0.90 (64p), depending on which version of the program is installed.

The Symbian operating system is used in phones made by Nokia, Motorola, Samsung and Sony Ericsson, among others.

Criminals have created banking Trojans for the PC that silently transfer money during online banking sessions, but this is the first time Schouwenberg has seen this type of behaviour on a mobile phone.

Schouwenberg did not know which Indonesian mobile service provider was targeted in this attack.