6 ms·

Russia's Massive Android Malware Industry Revealed

64 points by hkimura 13y ago

barista 13y ago
what makes this scary is this line: "The report found the bulk of this Russian malware wasn't coming from lone individuals in basements, but well-oiled malware producing machines."
- zalew 13y ago
  Sounds sensational, but it's not that different from the spam drug affiliates scheme. SMS malware is a topic old as coal on the darknet, there is even a tutorial on the hidden wiki; what I'm curious about is where those apps are distributed, AFAIK google play deals with it (at least the obvious sms ones) pretty well. From what I hear people complaining often on HN, in the US carriers are tied with Google. Meanwhile here in Poland I rarely see a phone that has google apps out of the box (usually there is some crapware from the carrier, a shitty nav app instead of gmaps, and maybe a youtube app and that's it) and external appstores are unlocked by default - I can assume it's a similar situation in Russia and those malicious apps are distributed through some local app stores. Can somebody from Russia comment on that?
  - mjolk 13y ago
    >I can assume it's a similar situation in Russia and those malicious apps are distributed through some local app stores. Can somebody from Russia comment on that? It's usually harmless, 'cheaper-feeling' versions of popular applications. The malware that's being downloaded here is closer to getting a user to download a game that's similar to something popular -- think 'Minecraft Tips and Tricks App'
    - zalew 13y ago
      Yeah, but where are they distributed - some Russian app stores or international ones? If local, then people are not aware Russia and Ukraine are cracker/malware superpowers? :)
      - guard-of-terra 13y ago
        I think there aren't any big Russian app stores (Yandex Store comes to mind but it's not big yet). I've seen numerous reports of Google Play apps being served with malware / showing malware-triggering ads. So it's cat and mouse even with international stores.
        zalew 13y ago
        Yeah, sadly. But at least Google has the resources to learn on false negatives. There have been a few malware scandals, but they are usually cut off short in bulk just after exposed. I doubt smaller stores are able to perform that well in this area, not to mention that those Russian ones probably are the scammers themselves as the phones have non-google app stores unlocked and it only takes a spammy redirect. All that said, as you mentioned in the other comment - the root of the problem are cell companies, if not for them, the premium sms problem wouldn't exist.
      - mjolk 13y ago
        App store, via being led through affiliate links to the data source, or via exploits in default software. You can peddle malware through the official play store for a while until you get caught -- at which point, you rename the application, register a new dev account, and keep going. I don't know where the servers are physically located, nor does it matter.
  - guard-of-terra 13y ago
    In Russia you don't get your phone from carrier, you buy it in pristine condition from respective (Android) vendor. Vendors put crapware there too but not much.
guard-of-terra 13y ago
This would not actually be possible if the operators weren't profiting from SMS shortcodes. Those are used for fradulent services in like 95% cases. But, operators get as much as 50% share, so why bother getting rid of scammers? I seriously want to see top managers of Russian cell operators in jail.
- zalew 13y ago
  > I seriously want to see top managers of Russian cell operators in jail. => I seriously want to see top managers of every cell operator out there in jail. FTFY It's not a Russian problem, google for premium sms and you'll find international tables for countries all around the world. I've heard some providers give clients the option to disable premium sms, too bad it's not a sane default. Also, don't know how it is in the US, but around here premium sms are very popular among live tv shows - vote for your favorite dancer, etc. So it's a hard case to beat when mass media is tied with them.
  - guard-of-terra 13y ago
    If you call them and persuade, they will: - Refund your money - Disable everything "premium" (fradulent) forever for your account. - Legit mobile payments still pass, you will wonder! Just not those evil invisible recurrent account-draining ones. In short, they understand that their multi-billion-dollar business is a bitch for low scammers and they live with it. They are in business of defrauding children, elderly and vulnerable people who have better things to do than be careful and track their balance. People got hang at Nuremberg for less I would say.
    - GoodIntentions 13y ago
      >>People got hang at Nuremberg for less I would say. No. There were people at Nuremberg who richly deserved hanging and didn't get it. The allies went easy on their best new buddy in the impending cold-war. ( Edit to say what motivated this reply in the first place - You can't compare working people to death in camps with SMS fraud. not anyplace close )
  - 13y ago
babuskov 13y ago
Author needs to get his facts right: "SMS shortcodes that bill victims via their wireless carrier. In the U.S., we often see these attached..." versus "Readers in the U.S. can rest easy, since most of these scams use specific short codes that won't work outside Russia" So, which one is it?
- guard-of-terra 13y ago
  Every country have a different set of shortcodes. You can't use Russian shortcodes from the US and it's not easy to harness US shortcodes for Russian resident, especially fraudster (and vice versa). That's how Eurovision voting works for example.
  - zalew 13y ago
    Well, if I were a smart superscammer, which those guys probably are, I'd use geolocation and apply the code for said country. It ain't rocket science. They probably have to do it anyway to cover neighbor republics.
  - babuskov 13y ago
    I'm sorry, but you're wrong. I have SMS payments for two of my games in 30+ countries worldwide. You can use the same code as long as it is free to register. But the whole code story is completely irrelevant! If malware is installed in your Android phone it can send any arbitrary short code it wants, without you noticing. What is important is the number to which you send the code, and this is different for each country (and even different for different carriers in some countries). So, a well coded malware with international support would need to know the premium payment number + code pairs for all the countries the attacker wishes to gather money from.
    - guard-of-terra 13y ago
      They should also be able to move their fradulent money away from those countries which is going to be problematic.
- 13y ago
MrKurtz 13y ago
Instead of just regurgitating whatever is handed out to them, these publication ought to be more skeptical of the claims of a company like Lookout whose business is built on FUD, especially when they are spreading that FUD about the only platform that lets them make a living. I'm not suggesting that there are no potential threats, what I'm suggesting is that they often omit the caveats and mitigating factors such as that the official Play Store doesn't host malware and even if something slipped in it wouldn't survive for long. The main concern would be about sideloaded apps and even then devices with Google Play Services installed (most of them) can still scan them: http://www.androidpolice.com/2013/07/28/googles-malware-scanner-introduced-in-android-4-2-moved-to-the-google-play-services-app-now-works-on-gingerbread-and-higher/ http://www.androidpolice.com/2013/07/28/googles-malware-scan... Also Android 4.2 introduced premium SMS protection: More control of premium SMS - Android will provide a notification if an application attempts to send SMS to a short code that uses premium services which might cause additional charges. The user can choose whether to allow the application to send the message or block it. https://source.android.com/devices/tech/security/enhancements.html https://source.android.com/devices/tech/security/enhancement...
- babuskov 13y ago
  I agree with you that article is FUD and has many facts wrong. However, the last thing you wrote about Android 4.2 is not that important as Android 4.2 holds only 6% of the market: http://developer.android.com/about/dashboards/index.html http://developer.android.com/about/dashboards/index.html
- zalew 13y ago
  > devices with Google Play Services installed (most of them) not in Russia (see the other comment sub-thread here https://news.ycombinator.com/item?id=6149405 https://news.ycombinator.com/item?id=6149405).
  - MrKurtz 13y ago
    Good point, they should have made that distinction in the article.
- 13y ago
guard-of-terra 13y ago
To all Russians out there, consider voting & promoting https://www.roi.ru/poll/petition/problemy-potrebitelej-i-plohoj-servis/likvidatciya-svedenie-k-minimumu-vozmozhnosti-moshennichestva-s-ispolzovaniem-uslug-mobilnoj-svyazi/ https://www.roi.ru/poll/petition/problemy-potrebitelej-i-plo...
AsymetricCom 13y ago
Wow really? You'd think a country with a collapsed government and unstable social system would be building fighter jets, gourmet cuisine and cloud services, not making money with shady organized crime. The shame!

64 points by hkimura 13y ago

what makes this scary is this line: "The report found the bulk of this Russian malware wasn't coming from lone individuals in basements, but well-oiled malware producing machines."

zalew 13y ago
Sounds sensational, but it's not that different from the spam drug affiliates scheme. SMS malware is a topic old as coal on the darknet, there is even a tutorial on the hidden wiki; what I'm curious about is where those apps are distributed, AFAIK google play deals with it (at least the obvious sms ones) pretty well. From what I hear people complaining often on HN, in the US carriers are tied with Google. Meanwhile here in Poland I rarely see a phone that has google apps out of the box (usually there is some crapware from the carrier, a shitty nav app instead of gmaps, and maybe a youtube app and that's it) and external appstores are unlocked by default - I can assume it's a similar situation in Russia and those malicious apps are distributed through some local app stores. Can somebody from Russia comment on that?
- mjolk 13y ago
  >I can assume it's a similar situation in Russia and those malicious apps are distributed through some local app stores. Can somebody from Russia comment on that? It's usually harmless, 'cheaper-feeling' versions of popular applications. The malware that's being downloaded here is closer to getting a user to download a game that's similar to something popular -- think 'Minecraft Tips and Tricks App'
  - zalew 13y ago
    Yeah, but where are they distributed - some Russian app stores or international ones? If local, then people are not aware Russia and Ukraine are cracker/malware superpowers? :)
    - guard-of-terra 13y ago
      I think there aren't any big Russian app stores (Yandex Store comes to mind but it's not big yet). I've seen numerous reports of Google Play apps being served with malware / showing malware-triggering ads. So it's cat and mouse even with international stores.
      - zalew 13y ago
        Yeah, sadly. But at least Google has the resources to learn on false negatives. There have been a few malware scandals, but they are usually cut off short in bulk just after exposed. I doubt smaller stores are able to perform that well in this area, not to mention that those Russian ones probably are the scammers themselves as the phones have non-google app stores unlocked and it only takes a spammy redirect. All that said, as you mentioned in the other comment - the root of the problem are cell companies, if not for them, the premium sms problem wouldn't exist.
    - mjolk 13y ago
      App store, via being led through affiliate links to the data source, or via exploits in default software. You can peddle malware through the official play store for a while until you get caught -- at which point, you rename the application, register a new dev account, and keep going. I don't know where the servers are physically located, nor does it matter.
- guard-of-terra 13y ago
  In Russia you don't get your phone from carrier, you buy it in pristine condition from respective (Android) vendor. Vendors put crapware there too but not much.

guard-of-terra 13y ago

This would not actually be possible if the operators weren't profiting from SMS shortcodes. Those are used for fradulent services in like 95% cases. But, operators get as much as 50% share, so why bother getting rid of scammers? I seriously want to see top managers of Russian cell operators in jail.

zalew 13y ago
> I seriously want to see top managers of Russian cell operators in jail. => I seriously want to see top managers of every cell operator out there in jail. FTFY It's not a Russian problem, google for premium sms and you'll find international tables for countries all around the world. I've heard some providers give clients the option to disable premium sms, too bad it's not a sane default. Also, don't know how it is in the US, but around here premium sms are very popular among live tv shows - vote for your favorite dancer, etc. So it's a hard case to beat when mass media is tied with them.
- guard-of-terra 13y ago
  If you call them and persuade, they will: - Refund your money - Disable everything "premium" (fradulent) forever for your account. - Legit mobile payments still pass, you will wonder! Just not those evil invisible recurrent account-draining ones. In short, they understand that their multi-billion-dollar business is a bitch for low scammers and they live with it. They are in business of defrauding children, elderly and vulnerable people who have better things to do than be careful and track their balance. People got hang at Nuremberg for less I would say.
  - GoodIntentions 13y ago
    >>People got hang at Nuremberg for less I would say. No. There were people at Nuremberg who richly deserved hanging and didn't get it. The allies went easy on their best new buddy in the impending cold-war. ( Edit to say what motivated this reply in the first place - You can't compare working people to death in camps with SMS fraud. not anyplace close )
- 13y ago

babuskov 13y ago

Author needs to get his facts right: "SMS shortcodes that bill victims via their wireless carrier. In the U.S., we often see these attached..." versus "Readers in the U.S. can rest easy, since most of these scams use specific short codes that won't work outside Russia" So, which one is it?

guard-of-terra 13y ago
Every country have a different set of shortcodes. You can't use Russian shortcodes from the US and it's not easy to harness US shortcodes for Russian resident, especially fraudster (and vice versa). That's how Eurovision voting works for example.
- zalew 13y ago
  Well, if I were a smart superscammer, which those guys probably are, I'd use geolocation and apply the code for said country. It ain't rocket science. They probably have to do it anyway to cover neighbor republics.
- babuskov 13y ago
  I'm sorry, but you're wrong. I have SMS payments for two of my games in 30+ countries worldwide. You can use the same code as long as it is free to register. But the whole code story is completely irrelevant! If malware is installed in your Android phone it can send any arbitrary short code it wants, without you noticing. What is important is the number to which you send the code, and this is different for each country (and even different for different carriers in some countries). So, a well coded malware with international support would need to know the premium payment number + code pairs for all the countries the attacker wishes to gather money from.
  - guard-of-terra 13y ago
    They should also be able to move their fradulent money away from those countries which is going to be problematic.
13y ago

MrKurtz 13y ago

Instead of just regurgitating whatever is handed out to them, these publication ought to be more skeptical of the claims of a company like Lookout whose business is built on FUD, especially when they are spreading that FUD about the only platform that lets them make a living. I'm not suggesting that there are no potential threats, what I'm suggesting is that they often omit the caveats and mitigating factors such as that the official Play Store doesn't host malware and even if something slipped in it wouldn't survive for long. The main concern would be about sideloaded apps and even then devices with Google Play Services installed (most of them) can still scan them: http://www.androidpolice.com/2013/07/28/googles-malware-scanner-introduced-in-android-4-2-moved-to-the-google-play-services-app-now-works-on-gingerbread-and-higher/ http://www.androidpolice.com/2013/07/28/googles-malware-scan... Also Android 4.2 introduced premium SMS protection: More control of premium SMS - Android will provide a notification if an application attempts to send SMS to a short code that uses premium services which might cause additional charges. The user can choose whether to allow the application to send the message or block it. https://source.android.com/devices/tech/security/enhancements.html https://source.android.com/devices/tech/security/enhancement...

babuskov 13y ago
I agree with you that article is FUD and has many facts wrong. However, the last thing you wrote about Android 4.2 is not that important as Android 4.2 holds only 6% of the market: http://developer.android.com/about/dashboards/index.html http://developer.android.com/about/dashboards/index.html
zalew 13y ago
> devices with Google Play Services installed (most of them) not in Russia (see the other comment sub-thread here https://news.ycombinator.com/item?id=6149405 https://news.ycombinator.com/item?id=6149405).
- MrKurtz 13y ago
  Good point, they should have made that distinction in the article.
13y ago

guard-of-terra 13y ago

To all Russians out there, consider voting & promoting https://www.roi.ru/poll/petition/problemy-potrebitelej-i-plohoj-servis/likvidatciya-svedenie-k-minimumu-vozmozhnosti-moshennichestva-s-ispolzovaniem-uslug-mobilnoj-svyazi/ https://www.roi.ru/poll/petition/problemy-potrebitelej-i-plo...

AsymetricCom 13y ago

Wow really? You'd think a country with a collapsed government and unstable social system would be building fighter jets, gourmet cuisine and cloud services, not making money with shady organized crime. The shame!