First Trojan spotted in Apple’s App Store
- — 06 July, 2012 09:59
- ( 1 Comment )
Security researchers at Kaspersky Lab have spotted the first trojan in Apple’s Russian App Store, which takes victims' phonebooks and lures them into ‘topping up’ the attacker's PayPal account.
The ‘Find and Call’ app has drawn the ire of Russian-speaking Android and iOS users who have posted “angry” complaints on both platforms’ feedback sections that the app sends SMS spam.
The app promises cheap international mobile calls using social network and email contacts as identifiers, but when launched it secretly uploads the user’s contact list to a remote server, according to Kaspersky Labs.
The app itself does not send spam, but the remote server use the details to spam contacts with an SMS containing a link to Find and Call's website, purportedly from the initial victim’s mobile.
“In other words, people will receive an SMS spam message from a trusted source,” said Kaspersky Lab expert Denis Maslennikov.
The website of the app requires the user to register before being able to add 'credit' to their account. The form in fact asks the user to use PayPal to pay a supposedly Singaporean-based company “Wealth Creation Laboratory” with the website “labwealth.com”.
The Find and Call website itself is operated from Moscow by “Nikolay Sergeichev”, according to the Who Is directory.
The ‘Find and Call’ website also encourages users to add their social network accounts and email addresses, likely to be used by the group behind the trojan, according to Maslennikov.
The trickery employed to make money for the app’s owners occurs outside the app and the app itself doesn’t appear to be doing anything that would break Apple's developer agreement, except that it does not explicitly asking for the user’s address book.
The practice of hiving off iOS user’s contact lists was in the spotlight this February, after social network Path was criticised for uploading and storing user’s contacts to their own servers.
It turned out the practice was widespread and that it was possible to acquire the contact list without explicit consent from the user, which Apple addressed after the outcry.
"Malware in Google Play is nothing new but it’s the first case that we’ve seen malware in the Apple App Store. It is worth mentioning that there have not been any incidents of malware inside the iOS Apple App Store since its launch 5 years ago," said Kaspersky's Maslennikov.
"But the main issue here is user’s privacy again. It’s not for the first time we see incidents related to user’s personal data and its leakage. And it’s not for the first time when we have confirmed cases of malicious usage of such data."
Follow @CSO_Australia and sign up to the CSO Australia newsletter.
Get exclusive access to CSO, invitation only events, reports & analysis. 
Comments
RedRapper
1
I wonder what negative impact this will have on other apps that have similar names. Hopefully apps like ReadAndCall and others which are good don't receive unwarranted negative reactions. Many developers work hard to produce good Apps and one bad "apple" can ruin countless hours of good work.