Android's rite of passage: Now it has a botnet
Connecting state and local government leaders
A spam-sending botnet that operates on Android devices could be the first of its kind, says a Microsoft researcher who discovered it
The spread of Android malware may have hit a new milestone recently, with the discovery of what could be the first botnet operating on smart phones, in this case smart phones running the Android operating system.
Microsoft security researcher Terry Zink wrote in a July 3 blog post that he came across spam samples from compromised Yahoo accounts that all included a message ID showing that they came from Android devices. And they all ended with the tagline: “Sent from Yahoo! Mail on Android.”
“We’ve all heard the rumors, but this is the first time I have seen it -- a spammer has control of a botnet that lives on Android devices,” Zink wrote. Infected devices will send spam from the user’s Yahoo mail account.
Related stories:
Android, Mac malware on rise, and beware mom-and-pop websites
DOD’s move to Android started with DARPA apps program
UPDATE: Since this story was published, Google issued a statement saying that the botnet is not running on Android devices and that the message ID is being spoofed to make it appear so, according to IDG News Service. Meanwhile, Sophos researchers say the spam does appear to be coming from Android smart phones and tablets, while BitDefender and Kaspersky Labs researchers say the evidence is not conclusive one way or the other, IDG reported.
The existence of smart-phone botnets could be a concern for government agencies that are incorporating Android and other mobile platforms into their enterprises, although this particular botnet likely wouldn’t affect an organization that manages the apps on its phones or sets rules for employees taking a “bring your own device” approach to work.
Zink said the messages he found come from IP addresses in Chile, Indonesia, Lebanon, Oman, Philippines, Russia, Saudi Arabia, Thailand, Ukraine and Venezuela, which could be an indication that the botnet is spreading through malware in a third-party app users have downloaded on the cheap.
Users in the developing world tend to be more lax about security than those in developed countries, and they are more likely to acquire a smart-phone app “from some guy in a back alley on the Internet,” increasing the chances of getting malware along with it, he wrote.
“I am betting that the users of those phones downloaded some malicious Android app in order to avoid paying for a legitimate version, and they got more than they bargained for,” Zink wrote. “Either that or they acquired a rogue Yahoo Mail app.”
Botnets have been a scourge of PCs for years, but as users and organization have moved to mobile platforms, spammers, phishers and other cyber attackers have followed. In the last year, the number of malware samples for mobile devices has quadrupled, according to McAfee’s quarterly Threat Report, released in May.
But whether you’re using a PC or a smart phone, the standard advice for avoiding getting hooked into a botnet is the same: regularly update your device with the latest patches and security upgrades; keep current with the latest browser versions, and be very careful about the links you click on.
If you receive a link that is at all suspicious, it would be better to type the URL into your browser than clicking on what could be a spoofed link, for instance. Or if someone sends you a link to a story on a news site or a product page for a company, you could go on your own to the site’s home page and look for the story or product from there.
And, of course, if your agency has rules for using mobile devices, it’s best to stay within the lines.