PRAGUE, Czech Republic: Researchers at the AVAST antivirus labs in Prague have discovered a new batch of fake alternative marketplaces for downloading smartphone apps that trick users into sending premium rate SMS messages. Using a variant of the Android:FakeInst family, the new marketplaces hosted at www.t2file.net, www.uons.net, www.uote.net and www.sofile.net are aimed at defrauding users looking for smartphone screen savers and games.
“All of these sites were registered just a week ago, so it looks like they were supposed to serve only as a malware platform,” explains Ondrej Vlcek, CTO of AVAST Software, “Accessing these URL’s via a browser generates an error message but using a smartphone prompts the user to install a downloader with a huge range of permissions including the ability to trigger premium rate SMS messages.”
Although the sites target Russian speakers, the fake downloader generates premium rate SMS based on the users country and contains numbers for 60 different countries in an AES encrypted XML file distributed with the application.
Whether the premium rate SMS service providers are complicit in this attempt to defraud smartphone customers is hard to gauge. However, Mr. Vlcek believes that Avast! is still the only anti-malware product to detect this new generation of premium SMS scamming applications.
Ondrej Vlcek warns, “Never trust weird looking alternative markets and always check the app permissions. If you’ve downloaded a game or screensaver that asks for SMS and Phone calls permissions, then you are likely to receive an unpleasant surprise in your next phone bill.“