Following on from our press release on the new MobileAuthority solution for mobile networks, we thought we’d give a quick roundup of some of the more common mobile spam and abuse attacks, and how to recognise them. One common theme in mobile abuse is that much of it is fraudulent, i.e. they are trying to scam you to get money, so it’s really important to be aware of the tricks they use.

Premium-Rate Number Scams

This is one of the most common type of spam, and it can be quite pernicious. The idea is to send you a message that tricks you into calling back or replying via SMS. The number you call or send a message to is actually registered as “Premium-Rate” number, and you get charged much higher fees for that call/message on your bill. Even worse are the unscrupulous folks who sign you up for ongoing subscription services that charge you each time they send you messages. Most countries have a code of practice regulating these services, and most providers of these services are legitimate, however you do have watch out for messages (always unsolicited) like the following:

Hi, it’s me! Call me back on this number

Sorry I missed your call, can you get back to me on this number?

You’ve won a cash prize! Reply to 27361 to claim your winnings!

The most important thing, as with all spam, is to look out for (and be suspicious of )  messages from unknown numbers, and also be aware of the premium rate number prefixes in your country. Here are a few examples:

France – 0899

UK – 09

USA – 900

For a fairly comprehensive list of premium rate numbers, there is an article on Wikipedia.

Some of these will be trying to get you to reply to a premium-rate shortcode; the lesson here is that practically all shortcodes that are not provided by your operator will cost you money to send to them. So be very careful when replying to SMS messages, especially those that come from shortcodes (these are typically 4-6 digit phone numbers, but unfortunately they don’t normally conform to a standard prefix, unlike premium-rate phone numbers).

Phishing

Phishing is a term that is used to describe malicious senders impersonating a company or institution (usually ones you might have a financial or billing relationship with) in the hope of getting you to give them information which might help them defraud you of money. This usually takes the form of them luring you to a website which looks just like your bank for example, and then stealing your authentication (login) information. It can also lead to identity theft, or using your details to add premium services to your bill, etc. Even worse are the phishers who setup automated voice response systems that sound just like your bank – many people just don’t expect to be scammed in this manner.

Phishing can be quite hard to detect on a mobile, because many of us don’t question the trustworthyness of the SMS messages we receive on our mobile phone that claim to be from our bank, mobile phone operator, credit card company etc. We would encourage everyone to be suspicious of these types of messages, particularly if you aren’t expecting them. Some example SMS phishing messages we’ve seen in the past:

BANK OF THE XXXXXXXX urgent account notification, verify unusual activity, call 1800-###

Dear Customer we are sorry to inform you that we had to lock your XXXXXX Credit Union access. To reactivate it call ###-###-####.

Viral Hoaxes

Viral hoax messages are often sent around – these can be very annoying, but are not typically considered harmful. They attempt to get you to forward a message to all your friends, in return for some reward for yourself (financial or even as tenuous as “good luck”). Here’s an example:

Text Message Holiday Special: Forward to 10 friends for $25 credit!

The message normally comes from your friends, and so appears trustworthy, and this alone is often enough to encourage people to follow the instructions in the message. As usual, our advice is – distrust any message that seems too good to be true, as it almost certainly is!

Mobile Viruses

Viruses do exist in the mobile world, and although it’s true that today they are not as prevalent as they are on PCs, they are growing in sophistication and penetration, particularly with the rise of smartphones. Transmitting a virus in an SMS message is actually pretty difficult, but we’ve recently seen the first example of a virus that uses SMS messages to propagate itself (the SexyView worm).

Without going into the specifics of SexyView, which are covered extensively elsewhere, it’s worth being aware that an unsolicited SMS message containing a web URL that looks really enticing (e.g. “Britney’s bare-faced cheek!“, “Ronaldo and Paris – the video“, “Video of WWII bomber found on moon!“), may actually take you to a website that downloads a virus to your mobile phone. In the case of this particular worm, the message appears to come from your friends, so you do have to be particularly vigilant. This kind of threat is only going to grow in the future, and could even be used to turn your mobile phone into a spam-sending bot, of the type commonly found on PCs, which would have serious implications for your next phone bill.

We’ll almost certainly revisit this topic in future blogs, as sadly mobile abuse is only going to increase in the future – all too obvious when you think that mobile is by far the world’s largest addressable communication medium, and thus the most attractive target for the bad guys out there.

Neil

The Waledac botnet is trying to grow again, and the herders may have hit upon a great new twist. Waledac bots are currently sending out huge numbers of fake Reuters news articles about a bombing near the recipient’s location. These emails point to a “Breaking News” website that claims to have a link to video of the story that requires you to update your Flash player (except that what they serve you is not a new Flash player, but a bot infestation).

What makes this unusual is that fake news story (or, rather, the machines that host it). The infected machines serving the ‘news story’ webpages are also performing geolocation tests against the IPs trying to pull the page, and altering the content based on where they think that IP is located. If they can determine where you are, the ‘breaking news’ story that you get will be tailored to you, saying that the bombing took place in a town near you. In terms of social engineering, this goes a long way to making the content more believable.

How can you protect yourself from this? To start, make sure your anti-virus signatures are up to date. Be wary of previously unknown sites – don’t install software just because a website told you to. Visit the US Computer Emergency Readiness Team (US-CERT) website – they’ve got great papers on avoiding social engineering attacks and other email scams.