Android smartphones hijacked to build first mobile botnet

Google believes signatures are fake

Researchers have spotted evidence of what could be the first extensive global smartphone botnet running on compromised Android devices owned by subscribers in a range of developing countries.

In a brief blog airing the evidence, Forefront Online Security engineer Terry Zink said he'd noticed that pharmacy spam coming through Yahoo's email service were signed with the telltale 'Sent from Yahoo! Mail on Android' signature at the end of each message.

An examination of the embedded IP addresses showed they came from Chile, Indonesia, Lebanon, Oman, Philippines, Russia, Saudi Arabia, Thailand, Ukraine, and Venezuela.

"All of these message are sent from Android devices. We've all heard the rumors, but this is the first time I have seen it - a spammer has control of a botnet that lives on Android devices. These devices login to the user's Yahoo Mail account and send spam," said Zink.

The most likely explanation was that the infected users had installed a rogue app from a non-approved Android market, he said.

"I am betting that the users of those phones downloaded some malicious Android app in order to avoid paying for a legitimate version and they got more than they bargained for. Either that or they acquired a rogue Yahoo Mail app," wrote Zink.

"This is the next evolution in the cat-and-mouse game that is email security," he added, referring to longstanding fears that malware authors would start building mobile bots to complement the hordes that already hosted on infected Windows PCs.

Security firm Sophos confirmed Zink's research, agreeing that the spam has been coming from legitimate Yahoo accounts.

"It is likely that Android users are downloading Trojanized pirated copies of paid Android applications. The samples we analyzed originated in Argentina, Ukraine, Pakistan, Jordan and Russia," said Sophos's Chester Wisniewski.

Should the average Android in the UK and US user be unduly worried? Not really. The counterfeit 'wrapper' apps that set up this botnet are unlikely to have come from Google Play, the renamed and somewhat reformed market the search giant set up to fix previous criticisms that it wasn't vetting apps on its marketplace. Criminals will be using non-approved download sites to entrap users.

It does underline that mobile networks and devices are often barely undefended, making it easier to build mobile bots than previously assumed. The new evidence is the first verifiable evidence of an Android botnet being built on any scale using compromised subscribers.

The bot (or bots) in question could also be substantial given that subscribers from multiple countries appear to be involved. Mobile bots are harder to spot - or perhaps fewer researchers are looking for them - which suggests this one could have been around for some time.

"Android users should exercise caution when downloading applications for their devices and definitely avoid downloading pirated programs from unofficial sources," said Wisniewski.

"Google, Amazon and others may not be perfect at keeping malware off of their stores, but the risk increases dramatically outside of their ecosystems."

Update: Google later issued a statement that refuted the botnet claims.

"The evidence does not support the Android botnet claim. Our analysis suggests that spammers are using infected computers and a fake mobile signature to try to bypass anti-spam mechanisms in the email platform they're using," reported ZDNet.

Join the CSO newsletter!

Error: Please check your email address.
Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by John E Dunn

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts