Google says spam emails not coming from Android botnets

The company on Thursday disputed security researchers from Microsoft and Sophos

Google on Thursday dismissed the possibility that a new wave of pharmacy, penny stock and e-card spam emails are being sent by Android spam botnets.

"Our analysis suggests that spammers are using infected computers and a fake mobile signature to try to bypass anti-spam mechanisms in the email platform they're using," a Google spokesman said via email in response to security researchers from Microsoft and antivirus firm Sophos who first identified what they believed to be the handiwork of an Android botnet.

Terry Zink, program manager for Microsoft Forefront Online Security, was the first to report about the spam messages in a blog post on Tuesday, noting that all of the emails come from Yahoo's servers and they are sent from Android devices. "We've all heard the rumors, but this is the first time I have seen it -- a spammer has control of a botnet that lives on Android devices," Zink said. "These devices login to the user's Yahoo Mail account and send spam."

In a new blog post Thursday, Zink said that it is entirely possible that the Android Message-IDs from the spam email headers and the "Sent from Yahoo! Mail on Android" taglines were added by Windows malware as part of an elaborate deception to make it appear that the spam was coming from Android devices. However, it's similarly possible that these messages appear in this way because they do in fact come from Android devices, he said.

"Before writing my previous post, I considered both options but selected the latter," he wrote.

Security researchers from Sophos have also analyzed the spam messages, which advertise generic meds, penny stocks and e-cards, and have arrived at the same conclusion. "The messages appear to originate from compromised Google Android smartphones or tablets," Sophos senior security advisor Chester Wisniewski said in a blog post on Thursday.

The researchers don't have a copy of the Android malware responsible for this spam campaign, but there is indirect evidence that suggests that the emails are being sent from Android devices.

The value of the Message-ID field in the email headers mentions "androidMobile" and the messages themselves end with "sent from Yahoo! Mail on Android," Zink said.

In addition, many of the originating IP addresses, which are present in the email headers, are assigned to mobile-phone network operators, Wisniewski said via email.

Based on the IP addresses seen so far, the infected devices are located in countries like Ukraine, Russia, Chile, Argentina, Venezuela, Indonesia, Thailand, Philippines, Lebanon, Oman and Saudi Arabia.

It's not clear how these devices got infected, but the likely scenario is that their owners downloaded pirated copies of legitimate commercial apps and those copies also contained malware, Wisniewski said.

The immediate consequence for victims could be a higher mobile phone bill. Sending thousands of spam messages can generate a lot of mobile data traffic and mobile data is not cheap in most countries.

Android Trojan apps have been used in the past to steal data, send SMS messages to premium-rate numbers or display unwanted advertisements. However, they've never been used to send spam before.

"If confirmed, the discovery of an Android botnet capable of sending spam will mark a milestone: at the moment there are more than one billion smartphones activated in the world and most of them are always connected to the Internet at all times, so they can pump up spam 24/7," said Bogdan Botezatu, a senior e-threat analyst at antivirus vendor BitDefender, via email.

BitDefender researchers are analyzing a malware sample that they believe might be connected to these spam campaigns. However, the company can't confirm the botnet's existence for now, Botezatu said.

Not all security researchers are convinced by the evidence found so far. "Currently we can't confirm - or deny - the existence of this supposed Android botnet," said Denis Maslennikov, a senior malware analyst at security firm Kaspersky Lab, via email. "The evidence put forward to claim that this is an Android botnet is based on data which is easily spoofed/forged."

Join the CSO newsletter!

Error: Please check your email address.
Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place