Malicious Android Apps Steal Text Messages

Sophos Naked Security alerted us to two Android apps that are included in the Google Play Store as legitimate apps.  This makes these apps particularly dangerous, if you are following our advice to only install apps from legitimate sources.  Once installed, they download a plug-in that harvests your text messages and sends them to a web server.  Since the plug-in is downloaded after installation from another source, the developers managed to evade the usual software checks at Google.  Sophos is working with Google to have these apps removed from the store.

One app is for “App Play Store”, and the other is for “Skin Care Magazine”.  If you have installed these apps, it would be best to remove them from your phone.

Many apps as for a variety of permissions when you install them.  You may want to ask yourself what some of the permissions are used for.  Why does a game need my location information, for instance?  It is possible to un-check permissions before installation.

This is another reminder that smartphones need security too.  Most anti-malware companies that make computer security software also have apps fro the Android and iPhone markets, including the free Sophos Mobile Security for Android.  If you are unprotected, install one of these now!

More information:

0

About the Author:

Cybersecurity guru to business owners in the St Paul, Minneapolis, and western Wisconsin area. Computer security and hacking have been a passion of mine since I entered the computer and networking business in 2000. In 2013 I completed a course of study and certification exam to become a Certified Ethical Hacker (CEH). In 2016 I was certified as a Certified Information Systems Security Professional (CISSP). As Senior Cybersecurity Engineer at Computer Integration Technologies, I help our clients experience high levels of computer security, network security, and web site security. In addition to consulting on security products and services, we also conduct security audits, vulnerability assessments and full penetration tests. We also provide Cybersecurity Awareness Training for clients and their employees. We also work with companies and organizations that need to certify compliance with regulations such as PCI-DSS (credit card processing), HIPAA/HITECH (medical records), and GLBA. The views expressed on this Web site are mine alone and do not necessarily represent the views of my employer.

Add a Comment