Pierluigi Paganini December 29, 2012

In line with expectations a new cyber threat is menacing the mobile, in particular the most diffused OS, Android. The Russian anti-virus vendor Doctor Web has detected a new malware, dubbed  TheAndroid.DDoS.1.origin, that target Android mobile allowing the attacker to carry out mobile denial of service attacks.

Currently is not known how the trojan has infected mobile devices but security experts believe that it appears to disguise itself as a legitimate Google Play, adopting a social engineering technique.

The malicious code is very cunning, it works silently in background, hidden to the mobile user, and once the victim has been infected it contacts the Command & Control server communicating a series of information on the devices such as its phone number. The phone number is used by hackers to send commands to the device via SMS.

TheAndroid.DDoS.1.origin malware creates an icon on the desktop equal to the Google Play one, when user clicks on it the malicious code is executed, but the shortcut also opens the legitimate Google Play in order to avoid raising any suspicion.

One of the principal features of the malware is its capability to transform the mobile device in a bot to conduct DDoS attack, once the C&C server send to the phone the DDoS command , TheAndroid.DDoS.1.origin starts to flood the target address with data packets.

Doctor Web blog post states:

“Activities of the Trojan can lower performance of the infected handset and affect the well-being of its owner, as access to the Internet and SMS are chargeable services. Should the device send messages to premium numbers, malicious activities will cost the user even more.“

Another monetization schema implemented by criminals consists to sending out SMS messages to certain numbers to sign up the victim for premium mobile services, SMS can be sent to premium rate numbers charging the fraudsters’ wallet.

To avoid similar cyber threat it is fundamental that mobile users follow few simple best practices such as never jailbreak the phone neither download applications from third part Appstore and of course install a security software also on the mobile. Another valid suggestion for user is to be sure of the content he download verifying its reputation controlling app rating and user reviews, and of course be aware of any request the apps make asking for various permissions.

Pierluigi Paganini