Spammed text messages have begun circulating that can infect Android handsets, causing them to continually send virulent text messages to thousands of live phone numbers each day.
That discovery comes as hackers continue to probe the Android platform for security holes — with no slowdown expected in 2013.
“The mobile threat continues to grow at a very rapid pace with threats only increasing in complexity,” says Dan Hoffman, mobile security researcher at networking technology firm Juniper Networks.
Messaging security firm Cloudmark Research recently discovered a spam campaign that sends texts to Android users offering free versions of Need for Speed Most Wanted, Grand Theft Auto and other popular games.
By installing the free app, the user downloads a hidden program connecting the handset to a server in Hong Kong, Cloudmark researcher Andrew Conway says. The server sends the handset 50 phone numbers, copies of viral messages and instructions to begin sending the messages to each number.
Previously, Android spammers had to assemble and activate dozens of SIM cards — the chip at the heart of cellphones — and each card acted as an individual spam-blasting phone. But that can get expensive, and carriers have gotten better at detecting and blocking such campaigns.
Using infected Android handsets, instead, is akin to how spammers use infected PCs to spread spam.
Victims can lose in two ways. If they don't have an unlimited texting plan, the next phone bill could be a whopper. It takes about 65 seconds to automatically text 50 phone numbers, after which the server sends a fresh batch of numbers. So each infected phone can blast thousands of viral text messages a day.
What's more, the malicious program blocks incoming messages from anyone not on the user's contact list. “So the phone company or a friend can't text you back and say, ‘Stop sending me spam,' ” Conway says. In such cases, the carrier could decide to unilaterally shut down the user's text-messaging capabilities, he says.
Cloudmark estimates that only a few thousand Android smartphones have been infected, though tainted text messages continue to circulate.
Apple, Microsoft and Research In Motion smartphones are much less targeted. That's because Google designed Android as an open system.
Conway advises Android users to stick to Google's app store, Google Play, and ignore unsolicited offers that arrive by text message. If you see a suspicious text message offer, forward it to 7726, a free service set up by the carriers to eliminate spam.
