Analysts see alarming development in mobile malware

For the first time, a piece of mobile malware can send and receive information from a remote server

The first worm that spreads between mobile devices by spamming text messages has developed a new communications capability that one security vendor says signals the arrival of mobile botnets.

Trend Micro has analyzed a piece of mobile malware known as "Sexy Space," which is a variant of another piece of mobile malware called Sexy View, which targets devices running the Symbian S60 OS.

Sexy View, which was detected by vendors such as F-Secure six months ago, is significant because it is the first known malware sample that spreads by SMS (Short Message Service). It appeared initially in China.

Infected phones would send SMSes to everyone in the phone's contact list with a link to a Web site. If someone clicked the link, they would then be prompted to install Sexy View, which purports to offer pornography-related content.

In another advancement, those who wrote Sexy View were able to get the application approved and signed by Symbian. The OS manufacturer, now owned by Nokia, vets applications for security using both manual and automated processes, said Mikko Hypponen, chief research officer for F-Secure.

Sexy View's creators were somehow able to subvert that automated vetting process, allowing the application to access functions such as SMS, Hypponen said. The latest variant, Sexy Space, is also signed by Symbian.

But in the latest alarming development, Trend Micro analysts have found that Sexy Space is capable of downloading new SMS templates from a remote server in order to send out new SMS spam, said Rik Ferguson, senior security advisor for Trend.

No malware for a mobile device has been know to do that before. Analysts at Trend had "heated internal discussions" about whether Sexy Space qualified as botnet code, Ferguson said.

Sexy Space is also capable of stealing subscriber and network information from the device and sending it to a remote server, Ferguson said.

Sexy Space confirms what analysts such as Hypponen and Ferguson have said since late last year: As mobile devices take on greater functionality and operate like minicomputers, it's likely they will be targeted by malware writers and eventually lassoed into botnets.

Botnets -- arguably one of the biggest security threats facing the Internet -- are networks of hacked computers that can be used to send spam, conduct denial-of-service attacks on Web sites or steal data.

Hypponen said F-Secure analysts had not confirmed that Sexy Space calls on a remote server, and Trend engineers are still studying where the remote server is located.

It's not clear now many phones may be infected. But one Beijing mobile security vendor, NetQin Tech, wrote on its blog that infections had been widespread in China and Saudi Arabia.

F-Secure informed Symbian about the malware. It is possible for network operators to revoke the certificate that allows an application to run on a Symbian phone, Hypponen said.

But the revocation mechanisms are not automatic, and depending on the operator's setup, it may not work for all phones, Hypponen said.

Symbian has taken action to disable the malware. Craig Heath, one of Symbian's security developers, wrote on the organization's security blog that it has revoked the content certificate and publisher certificate used to sign the malware.

"That means that the Symbian software installer will not now install the malware, providing that revocation checking is turned on," Heath wrote. "Unfortunately, revocation checking is often turned off by phone manufacturers, because the data traffic could cause problems for people who do not have a data plan as part of their service or who pay for data by volume."

F-Secure has a writeup of the malware, also known as "Transmitter." Trend has also posted an analysis.

Join the PC World newsletter!

Error: Please check your email address.

Tags mobile malwaremobile phonessecuritysmartphones

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?