Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.
Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.
The Android malware threat is growing.
As financially-motivated cybercriminals realise there's a real opportunity to make money, so we are seeing more attacks created and distributed which target Android devices.
And it's no surprise to see similar social engineering tricks that have worked on other operating systems in the past also being used on the Android platform.
Like fake anti-virus, for instance.
As our friends at GFI described earlier this week, criminals spammed out links via Twitter pointing to webpages that contained a rogue app posing as a legitimate virus scanner.
SophosLabs researcher Vanja Svajcer investigated the case, and discovered the .ru domains pointed to the same IP address hosted in Ukraine.
When visited, the webpages determine whether it would be more appropriate to serve up a Java ME .jar file (for phones which are "not-so-smart") or an Android .apk.
Depending on the URL you click on and URL parameters, you might be prompted (in Russian) to install fake updates for a variety of products including the Opera browser and Skype.
Or you might be presented with a page which prompts you to run a security scan on your phone. Of course, the anti-virus "scan" it initiates is completely fake, and is designed to frighten you into installing an app onto your phone.
The look of the fake anti-virus scans can vary. Here's another version, which has adopted a more traditional "Android green" theme:
All of this subterfuge is being undertaken, of course, for just one purpose: to trick you into downloading and installing an app onto your Android phone.
In this case, the program pretending to be an anti-virus app has even stolen an icon to trick the unwary into believing it may have been coded by Kaspersky.
If you went ahead and installed the app onto your mobile, it would attempt to send expensive SMS messages to premium rate services, and has the ability to download and install further code from the internet onto your Android smartphone.
Sophos products detect these latest threats as members of the Andr/Boxer family of malware.
Follow @gcluleyThanks to SophosLabs researcher Vanja Svajcer for his assistance with this article.
MalwareData lossSocial networksMobileApplePrivacyVulnerabilityMore...Search for:
About the authorChester Wisniewski is a Senior Security Advisor at Sophos Canada. He provides advice and insight into the latest threats for security and IT professionals with the goal of providing clear guidance on complex topics.You can follow Chester on Twitter as @chetwisniewski or send him an email at chesterw@sophos.com.
var OBCTm='1328889400668';utmx_section("Test trigger")jQuery(document).ready(function($){ Gravatar.profile_cb = function( h, d ) { WPGroHo.syncProfileData( h, d );}; Gravatar.my_hash = WPGroHo.my_hash; Gravatar.init( 'body', '#wp-admin-bar-my-account' ); });.reblog-from img { margin: 0 10px 0 0; vertical-align: middle; padding: 0; border: 0; }.reblogger-note img.avatar { float: left; padding: 0; border: 0; }.reblogger-note-content { margin: 0 0 20px 35px; }.reblog-post { border-left: 3px solid #eee; padding-left: 15px; }.reblog-post ul.thumb-list { display: block; list-style: none; margin: 2px 0; padding: 0; clear: both; }.reblog-post ul.thumb-list li { display: inline; margin: 0; padding: 0 1px; border: 0; }.reblog-post ul.thumb-list li a { margin: 0; padding: 0; border: 0; }.reblog-post ul.thumb-list li img { margin: 0; padding: 0; border: 0; }.reblog-post { border-left: 3px solid #eee; padding-left: 15px; }.reblog-post .wpcom-enhanced-excerpt { clear: both; }.reblog-post .wpcom-enhanced-excerpt address,.reblog-post .wpcom-enhanced-excerpt li,.reblog-post .wpcom-enhanced-excerpt h1,.reblog-post .wpcom-enhanced-excerpt h2,.reblog-post .wpcom-enhanced-excerpt h3,.reblog-post .wpcom-enhanced-excerpt h4,.reblog-post .wpcom-enhanced-excerpt h5,.reblog-post .wpcom-enhanced-excerpt h6,.reblog-post .wpcom-enhanced-excerpt p { font-size: 100% !important; }.reblog-post .wpcom-enhanced-excerpt blockquote,.reblog-post .wpcom-enhanced-excerpt pre,.reblog-post .wpcom-enhanced-excerpt code,.reblog-post .wpcom-enhanced-excerpt q { font-size: 98% !important; }