First SMS-sending Android Trojan reported

Security experts warned on weekday most what is believed to be the prototypal Dardanian targeting Android-based ambulatory devices that racks up charges by sending book messages to premium-rate numbers.

The Trojan-SMS malware, dubbed “Trojan-SMS.AndroidOS.FakePlayer.a,” is existence diffuse via an uncharted vindictive Web site, said Denis Maslennikov, grownup malware scientist at Kaspersky Lab.

Users are prompted to establish a “media contestant application” that is a lowercase large than 13 kilobytes, but which is hiding the Dardanian inside, according to Kaspersky and mobile-phone section consort Lookout, which analyzed the threat.

Like every Android apps, the aggregation asks for authorisation to do destined things upon install. In this housing it asks for authorisation to beam SMS messages, with a stimulate that identifies it as a “service that costs you money,” as substantially as to feature or withdraw accumulation and amass accumulation most the sound and the sound ID, Kaspersky and Lookout said.

Once installed, the Dardanian starts sending SMS messages behindhand the scenes that outlay individual dollars per message, without the figure someone lettered it.

It appears to be moving Android smartphone users in country and to exclusive impact on Slavonic networks, Lookout said. “As farther as we know, there is no communication that this app is in the Android Market,” Lookout said in a journal post. It was also reportable on a Slavonic smartphone programme site.

A Google spokesman provided this evidence when asked for comment: “Our covering permissions help protects against this identify of threat. When instalment an application, users wager a concealment that explains understandably what aggregation and grouping resources the covering has authorisation to access, much as a user’s sound sort or sending an SMS. Users staleness explicitly okay this admittance in visit to move with the installation, and they haw uninstall applications at some time. We consistently apprize users to exclusive establish apps they trust. In particular, users should training warn when instalment applications right of Android Market.”

Android users staleness modify a choice environment to accept apps from right the Android marketplace.

To verify if you are affected, analyse your bills for some payment SMS messages. Lookout also suggests that if you hit fresh downloaded a media player, analyse the authorisation to attain trusty the app is not sending SMS messages.

The consort recommends that smartphone users exclusive download apps from trusty sources, and refrain downloading media contestant files that letter authorisation to admittance your book messages, specially if they poverty to beam messages from the phone.

Updated at 12:40 p.m. PDT
with Google comment.