Riskware:Android/Fidall.A

Classification

Riskware

Riskware

Android iOS

Fidall.A

Summary

Fidall.A searches for contact details from the user's contact list, and synches the information with a remote server.

Automatic action

Once the scan is complete, the F-Secure security product will ask if you want to uninstall the file, move it to the quarantine or keep it installed on your device.

Suspect a file is incorrectly detected (a False Positive)?

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note You need administrative rights to change the settings.

For more Support

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

Distributed under the name Find and Call, this program first requests the user to register by providing their email address. It then searches for emails, addresses, and phone numbers from the user's contact list. This information is then synched with a remote server. Once synched, the server will send an SMS message containing a link to download the application to the contacts, which is essentially a spam. The SMS messages reportedly contain the user's phone number in the 'From' field.

Fidall.A's icon and request for the user to provide an email address

Another issue concerning Fidall.A is that the data transmitted between the device and the remote server is in plain text, which easily exposes the content if intercepted by another party.

The application is also fully capable of synching with the contacts from the user's email, Facebook, and Skype accounts. The application's website also reportedly allows user to enter their social network and online payment merchant details.

At the time of writing, both the Apple App Store and Google Play have removed the application. This incident marks the first time the Apple App Store has had to remove a trojan from its market.