I never would have thought this to happen, but I've gained a remarkable amount of followers since. Thank You. In fact, with almost 50,000 followers, I'm actually one of the most followed Finns on Twitter.
So I want to give something back.
My 50,000th follower will get a physical Bitcoin coin worth 1 BTC, made by Casascius.
But rewarding my latest follower and ignoring all the rest wouldn't be fair. So, I'll give another 1 BTC coin to a random follower.
"Transnistria, a breakaway part of the former Soviet Republic of Moldavia. No UN members recognise Transnistria, and effectively it sits beyond the reach of international law enforcement."
There's always something new to learn regarding the geography of malware…
We've discovered a server that only attacks and/or spams smartphones and tablets — and not PCs.
A Swedish-based colleague of ours, Johan, was recently using his (Android) phone to search for boat trips in the Galapagos Islands. He found a site called Vagabond. And on Vagabond he found an entry with a link to: galacruises.com.
From a Windows-based browser, the link redirects to a site called islasgalapagos.travel.
But the results are much different if a mobile device is used…
Mobile browsers are redirected to a .info domain which in turn redirects yet again.
Sometimes it redirects to a popular game on Google Play:
But much of the time, it's NSFW sites (here seen from a Windows Phone):
And sometimes… malware! (As was the case for Johan.)
Here you can see that the malicious .APK file was blocked by one of our "online" detections.
Specific "disk" detection identifies the threat as a variant of FakeInstaller: Trojan:Android/FakeInst.AV.
Our Mobile Security Safe Browser blocks the offending website:
Note: visiting the .info site without the attack's parameter will result in a redirection to google.com.
A site with an index page that redirects to google.com? Always a clue something's afoot.
While browsing Malaysiakini (a popular Malaysian website) on an Android phone, one of our analysts spotted this advertisement:
Clicking on the ad led to an external site displaying the following:
Looks reminiscent of the kind of text we've seen for years on webpages pushing rogues for Windows systems (and sometimes Mac).
Clicking on the "Download and Scan Now" button leads to an image, which looks like an antivirus app:
Clicking on the image brings you to a page that asks for your phone number and displays some interesting text:
"This is an ongoing subscription service until you quit. You will receive 4 sms per week and chargeable at RM4 per message. Only [REMOVED] user will receives max 3 sms per week and chargeable at RM4 per message. Data charges are billed separately by mobile operators."
So, it's an SMS subscription service. Provide a phone number, and the user gets an SMS message with registration instructions for the service.
Once registered, another SMS is sent providing a download link. When we tried the link, the only thing we got was a message saying "Sorry, you have exceeded the allowed download limit." The site's index page claims to be "under construction."
Fortunately, the SMS with the registration instructions also included instructions for stopping the service.
We normally recommend users read the permissions requested when downloading a mobile app. In this case, reading the text before downloading would also be prudent. This was probably not the service a user was looking for when they clicked on the ad.
Our Browsing Protection feature currently rates the site hosting the supposed APK download as Suspicious.
Updated to add:
Like Windows-based Rogueware, this "Android Antivirus" scam recognizes other operating systems — but fails to fine tune the bait.
According to his Twitter bio: he's a long-haired over-intoxicated geek from Sweden living in Finland, who likes shiny unixy things.
He's a senior software engineer/developer on our Mac Protection team (and a generally good guy).
If you're also a geek — Rasmus thinks it would be "neat" (that's a quote) if you'd give our "Safe Anywhere Mac Technology Preview" a try. The team is developing a new feature that they want to roll out in a few weeks time. So… if you have the skills to run beta software, Rasmus (and team) would really appreciate the feedback.
"Students will learn how traditional and mobile malware work, how they are analyzed and detected, peering through the underground ecosystem that drives this profitable but illegal business."
