Spam, content and theft

About new, promising "technologies" and promising directions in this area. Already well-known methods and techniques are also gradually mutating in line with the tightening of requirements on the part of operators. And they even try to be one step ahead, preparing in advance for the "defensive lines" that have not yet been set.

You and I also need to take into account both the old “tricks” of scammers and relatively recent methods. I will only be glad if many do not find anything new for themselves in this text. Unfortunately, there are probably more traps, and these traps are becoming more sophisticated and technologically “advanced”.

Android is the main target of attacks?

The predictions made two years ago are coming true, and Android smartphones are confidently leading the sad list of victims of virus writers. The old history with the MS Windows computer operating system is being repeated, the users of which suffer incomparably more from any Trojan-virus obscenity. The traditional argument about the “magic of big numbers” (percentage of users) does not quite work with regard to smartphones: there are more Android devices on hand, MESOTRENO_TECH but not so much more. The same iPhones are quite popular, but there is an order of magnitude less malware for them. Let's not have a holy war on the relative vulnerability of operating systems, just take note of the fact that the smartphone is vulnerable and quickly becomes an attractive target.

The danger is that too many users do not take their devices seriously: a smartphone is just a phone with additional features, what to worry about? While a modern smartphone is more like “just a computer” with the additional ability to make calls. Therefore, it is no longer necessary to talk about specific "telephone viruses", very soon we will rake in all sorts of virus-Trojan rubbish in full. Moreover, for scammers in a smartphone there is an additional advantage in the form of a SIM card with money on the balance sheet, and stealing this money through content is not difficult at all.


Judging by the results of "preparation" of modern computer Trojans, the emphasis of virus writers is beginning to shift to the financial and banking side. DDoS attacks have not lost their popularity, rather, on the contrary: they have become almost an official, routine tool of competition. But the prices for these services are falling, the power of attacks and the effectiveness of protection are growing proportionally, and the earnings of botnet owners are decreasing. It seems that extracting money directly from the bank account of the owner of the infected computer turned out to be more rational. I have read frightening predictions about the participation of hundreds of thousands of smartphones in future DDoS attacks, but I doubt the plausibility of such scenarios. But banking and content Trojans for smartphones will continue to improve and spread, including through mobile botnets.

The main obstacle to the uncontrolled spread of Android Trojans is the need to install an application not from Google Play, which cannot be done without the user's knowledge. But if a Trojan has settled in a smartphone, then getting rid of it can be difficult, and the financial consequences are sad. Therefore, it is better to think about prevention, and not deal with treatment later, no matter how trite this advice may look.

Obad, Opfake and Hesperbot

The "sweet couple" of Obad and Opfake is an example of "cooperation" of scammers. According to Kaspersky Lab, this is almost the first case they have registered when smartphones infected with a Trojan sent links to another Trojan in SMS messages. So to speak, they leased the resources of the botnet.

You can read a detailed description of this phenomenon here. As for the Obad.a trojan itself, this is a rare dirty trick that the user himself is unlikely to detect and not be able to remove. Quote from description:

". The attackers also found an error in OCAndroid related to the processing of AndroidManifest.xml. This file is found in every Android application and is used to describe the structure of the application, define its launch options, and so on. Virus writers modified AndroidManifest.xml in such a way that it did not meet the standard set by Google, but at the same time, thanks to the vulnerability found, it was correctly processed on a smartphone. As a result, dynamic analysis of the Trojan is extremely difficult.

The creators of Backdoor.AndroidOS.Obad.a used another previously unknown bug in the Android OS, which allows a malicious application to use extended DeviceAdministrator rights, but not be included in the list of applications with such rights. As a result, it is impossible to remove a malicious program that has received extended rights from a smartphone.

Finally, Backdoor.AndroidOS.Obad.a has no interface and runs in the background."

In fact, an infected smartphone lives its own life, which the owner only guesses about by the disappearance of money from the account. The Trojan requests a balance and, when money appears, sends SMS to paid numbers, the list of which it receives from the control server. SMS messages about debiting money and connecting subscriptions are intercepted and destroyed, at the command from the server, the Trojan sends links to “myself”, etc. to all numbers from the address book. According to experts, the bug in the Android OS has already been fixed in versions 4.3.x, but for the vast majority of current users, this is not a consolation.

This and other Trojans are distributed in four main ways:

  • SMS spam and social media fans ("You've got an MMS", "Update your software", etc.). To mask suspicious addresses, link shortening services are used; for the user, this is a “pig in a poke” in the form of a set of symbols that do not say anything. Judging by the analyzes of Kaspersky Lab experts, Trojans send such SMS to numbers from the address book of an infected smartphone, which is much more unpleasant, a link received from a friend is unlikely to arouse suspicion.
  • Fake Google Play app store pages. They are very similar to the real ones and, even worse, they are often like the official pages of a scammer with the "User Agreement" present. In which it is written that the Trojan mailer “included in the kit” of some game is not a Trojan at all, but a convenient way to pay for the work of a content creator who has collected and annotated popular free games on his page.
  • Automatically redirects the mobile device browser to a page with a "browser update", "player" or something else, it doesn't matter. In many cases, this is how dishonest Webmasters "earn money" by trading in mobile traffic and getting their pennies for each redirect to the Trojan download page. It is difficult to catch them in this case, since the user does not see the script, and when entering through a regular browser, everything is fine and blissful. I personally came across such tricks on reputable news sites and once even on the Russian Railways website.
  • Redirecting mobile traffic from hacked sites. It differs from the previous case in that the redirect always works and you can “break through” to such a site from a mobile device only through the Opera Mobile browser, which can “pretend” to be a PC browser. Whereas mobile click sellers usually enable this mode at night or during the day for short periods of time so as not to provoke suspicions and complaints.

Hesperbot is an example of a different kind. Here, they try to use a smartphone in conjunction with an infected computer to gain access to banking transactions protected by SMS verification with one-time passwords. A detailed analysis of this Trojan can be found on the ESET blog on Habrahabr, a few quotes:

". The new Trojan was named Win32/Spy.Hesperbot and is a powerful tool for stealing online banking data. Hesperbot has the following features:

  • interception of network traffic and HTML injection;
  • keylogger;
  • create desktop screenshots;
  • video capture;
  • creating a remote proxy connection;
  • create a hidden VNC server.

The goal of the attackers is to obtain the credentials that users use to log into their online banking account. In addition, the malicious code convinces the user to install their mobile component on a phone running Symbian, Blackberry or Android.

Hesperbot is not the first such malware that uses mobile components (ZitMo or SpitMo) to bypass the SMS-based authentication confirmation system (Mobile Transaction Authentication Number). A similar banking transaction confirmation system is widely used in many European countries and in Russia.

Hesperbot injects special JS scripts into web pages, through which the user is prompted to install an application for a mobile phone. The compromised user is offered a special list of phone models and after entering the phone number, the user is given a link to download a malicious mobile application. The application exists in versions for Symbian, Android and Blackberry. This malicious mobile application registers a special service that listens for incoming SMS messages and forwards them to the attacker's number. Thus, the attacker will receive the real code for the transaction. '.

This is also the question of whether SMS verification with one-time passwords can be considered guaranteed protection. Unfortunately, absolutely reliable protection does not exist in principle.

I'm not going to intimidate anyone or advertise antiviruses, just once again remind you of reasonable caution. And, of course, it is categorically not recommended to allow the smartphone to install applications from third-party sources. And if suddenly it was desperately needed, then after installation, do not forget to immediately remove the dangerous “tick”.

About spam

Unsolicited SMS-advertising of various taxis is already pretty tired, they would rather make changes to the legislation on this topic. There is also “technical” spam: here, in Citibank, something went wrong in the information system, and for the third month I have been warned about the expiration of a long-reissued credit card. I take this philosophically, although such spam infuriates many people and you can understand people, SMS inherently serve to convey urgent and / or important information.

And here is an interesting copy of a spam advertisement for another taxi. As far as I understand, systems for blocking spam through gateways and from other networks have not yet been enabled, and mailers have already begun experimenting with the substitution of individual Latin letters to mask spam. According to experts, modern SMS-spam filtering systems are almost impossible to deceive, we'll see.

In some cases, you can try to just disable SMS as a service, I'm thinking of doing it on my mom's phone. She does not send SMS and does not read spam, but the memory of a simple device is quickly clogged with incoming garbage and the red exclamation mark on the display annoys her.

The question was how to organize the balance check. In cases where the advertising text does not fit in the USSD, MTS sends the balance in an SMS message in response to the USSD request. But here they unanimously suggested to me that there is a tricky command # 100 # instead of * 100 #, in response to such a request, a regular USSD response comes without advertising. Really works, I recommend.

The number with the unusual DEF "900" refers to the numbering capacity of the Ekaterinburg 2000 mobile operator in the Kurgan region, but visually the number is similar to the toll-free 8-800 that banks often use for their contact centers. In any case, my first thought was “wow, scammers have already started renting free numbers!”.

About Subscriptions

The "good old" content subscriptions have not gone away, although they are much less common on the Internet than a year or two ago, this is a fact. But it also became more difficult to dodge them. Recently, in a fit of nostalgia, I was looking for a simple game of the beginning of this century, for about 20 minutes I was poking through various links in vain. Wherever you go, there is a paid Gold Account, VIP status or something else.

No, the free download option is also declared and present, but you will not be able to use it by definition.

After clicking on "Download for free", you get a sad message that the attempt failed, and the next one will be possible only after 12 hours. An alternative is to enter a phone number that will be “verified” and given free access for a day. "Check" consists in connecting a subscription for 600 rubles / month (20 rubles / day), who would doubt it.

And all this lewdness is spelled out in the "Terms and Conditions", which, if you wish, you can even get to the bottom of on the site. That is, the service, apparently, positions itself as a legal partner of a no less legal content provider. By the way, the file offered to me, judging by the size, was at best packed random garbage, and at worst it could turn out to be a trojan.