14 DAY TRIAL // Google has pulled another set of trojanized apps from the Android market which were silently subscribing users to premium rate services via SMS.
According to security researchers from AegisLab who analyzed the malicious code, the apps contained an SMS trojan.
They were posted by a user named "zsone" and had names like iBook, iCartoon, iCalendar, iMine, iMatch, iGuide, LoveBaby, 3D Cube horror terrible, Sea Ball, Shake Break or ShakeBanger.
Their number might be larger and the company is still investigation some suspicious ones, but at the moment, those have been confirmed as malicious.
It seems this SMS trojan is targeted at Chinese users, because it sends subscription codes to special numbers that only work in China. Also, the attackers have been taken measures to hide the malicious behavior.
"Take 'iCartoon' for instance, it sends SMS to 1066185829, 106601412004, 1066953930 when the users click to shift images for 5th time, with special coded text like YXX1 or 921X1 to subscribe unknown service. It does this just once, to prevent got noticed by the user," the AegisLab researchers note.
It's not clear if the rogue subscriptions result in a one-time charge or if users have their accounts billed monthly for the fake service.
SMS fraud trojans are common in China and Russia, where users rely on unofficial markets to download pirated apps for free.
This type of mobile malware has been observed in these countries since before smartphones became popular there. We have previously reported about Russian and Chinese SMS trojans designed for Symbian phones.
The increasing trend of uploading trojanized apps on the official Android Market is very concerning, especially since there is little oversight from Google regarding the publishing process.
Users are advised to read the permission requests carefully when installing apps and investigate those that want access to features that could cost money. For example, a game that asks for access to send SMS messages should immediately raise suspicion.