Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Hundreds of Google Play apps create spoofed messages in SMS inboxes

Symantec says technique could be used for text phishing attacks

Article comments

About 200 Android applications currently hosted on Google Play create spoofed SMS messages on the devices they are installed on, according to security researchers from antivirus vendor Symantec.

This technique can theoretically be used for SMS phishing, a type of attack where users are asked for sensitive information or to subscribe to paid services through rogue SMS messages that appear to originate from a trusted source.

However, the applications detected so far use the technique for other purposes, like displaying advertisements, said Mario Ballano, a security researcher at Symantec.

Last Friday, security researchers from North Carolina State University announced the discovery of a so-called "smishing" (SMS phishing) vulnerability in the Android Open Source Project (AOSP) - the code that serves as the basis for most Android firmware created by phone manufacturers.

The vulnerability allows a running app without any special permissions to directly write text messages with spoofed sender addresses (telephone numbers) and arbitrary content in the user's SMS inbox.

"We believe such a vulnerability can be readily exploited to launch various phishing attacks," Xuxian Jiang, an associate professor in the Department of Computer Science at NC State University, said at the time. The Google Android Security Team was notified and confirmed that a change will be made in a future Android release to stop this behaviour, he said.

However, the code to generate such spoofed SMS messages locally has been publicly documented and used since August 2010, Ballano said.

"We have recorded more than 250 applications that contain code using this technique including 200 that are currently available on Google Play with millions of combined downloads," the researcher said. "Some of the applications use the code to better integrate text messaging with instant messaging or other online services. The vast majority are using an ad-network software development kit (SDK), which pushes ads straight into your SMS inbox."

Even though Symantec has not yet detected an app that used this technique for SMS phishing, users should be wary of the source of any suspicious incoming text messages until Google solves this problem in Android, Ballano said.



Share:

More from Techworld

More relevant IT news

Comments



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *