For-profit malware has been increasing on the PC side for quite a few years now. Viruses that hold your files hostage, trojans that steal banking information and adware that floods your computer with popup ads. Malware writers have shifted their goals from gaining notoriety or personal satisfaction from the spread of their creations to the goal of filling their wallets.
Recently though, McAfee Avert Labs has begun to see a similar trend in mobile malware. Most of the mobile malware that we’ve run across has been relatively harmless trojan horses. A few files have been replaced, or the phone fails to start when reboot. A hard reset to clear the phone memory and you’re back to normal, minus your stored phone numbers and calendar information. You might have lost any time spent adding new software or saved documents, but at least none of your private information has been stolen. J2ME/Redbrowser changed the entire situation.
Redbrowser tells the user that it’s a mobile web browser that works over SMS. Instead of browsing to the address that the user wants, Redbrowser actually sends SMS messages to a Premium Rate number. On certain phones, the Java runtime will prevent Redbrowser from sending SMS messages without your permission. Redbrowser’s creator has gone to some length to social engineer you into saying yes when it asks to send the SMSes.
Stealing money in real life ranges from corporate embezzling to the common mugging. Where Redbrowser falls somewhere in between the two, J2ME/Wesber is closer to a mugging.
Like Redbrowser, Wesber also sends out SMS messages to premium number. It just doesn’t do it with as much style. Wesber has no user interface, so if the Java runtime doesn’t give a warning you would have no idea that you’ve just been charged roughly $15.
Wesber is found in a file named “pomoshnik.jar”. Pomoshnik is Russian and translates to “assistant”. It certainly assists its author in getting your money.
With the recent SMiShing incidents, the rise in for-profit mobile malware is definitely troubling.
December 6th, 2006 at 1:48 am
[…] Considering that data-stealing and other for-profit malware have made their entrance on mobile phones, it is worrisome to see spyware make its debut. Around eight months ago a commercial remote phone monitoring application was released. There was much speculation on how much time it would take for malware authors to integrate it into their own malware. We have seen malware authors create custom prototype code to implement new attacks but it is interesting to see them purchase commercial spyware to do their job for them. […]