Trojan Poses as CarrierIQ Solution
In November of last year, the mobile world was rattled when news of the CarrierIQ app secretly logging keystrokes and other mobile activities broke out. People became paranoid and wanted to get rid of the app so they can have some peace of mind. Many started searching for a solution – a quick fix– but some ended up regretting their actions.
Symantec and F-Secure released information that they have identified two Android malware apps posing as a CarrierIQ solution. They offer to remove the CarrierIQ app from your device, as well as unlock hidden features, but the Trojans actually send text messages to premium rate phone numbers.
“From our analysis, Android.Qicsomos is a modified version of an open source project meant to detect Carrier IQ on a device, with additional code to dial a premium SMS number,” Symantec stated.
How They Work
The first Trojan, Qicsomos, currently affects French Android customers. It hides in an app called “Detecteur de Carrier IQ” and appears on devices with an icon similar to Orange, a major European telecom operator. When the user notices the icon and presses “Désinstaller” (to uninstall Carrier IQ ), the Trojan goes to work: it sends four premium rate text messages, which the smartphone owner is then billed for, then erases itself.
The second Trojan, a malicious Russian Android market, pretends to scan the device for possible errors and new features that the vendor has hidden. Then once the scan is complete, a download link appears, which when clicked, will send text messages to a premium rate phone number.
Trouble In The Market
Symantec stated that “Detecteur de Carrier IQ 2.0.4,” is not found in the official Google Android Market, which led them to believe that the malware is spread via social engineering or phishing campaigns pretending to be from an official mobile carrier. That’s good news for consumers–it seems you’re still safe if you stick with apps from the verified Google Android Market.
Since you’re here …
… We’d like to tell you about our mission and how you can help us fulfill it. SiliconANGLE Media Inc.’s business model is based on the intrinsic value of the content, not advertising. Unlike many online publications, we don’t have a paywall or run banner advertising, because we want to keep our journalism open, without influence or the need to chase traffic.The journalism, reporting and commentary on SiliconANGLE — along with live, unscripted video from our Silicon Valley studio and globe-trotting video teams at theCUBE — take a lot of hard work, time and money. Keeping the quality high requires the support of sponsors who are aligned with our vision of ad-free journalism content.
If you like the reporting, video interviews and other ad-free content here, please take a moment to check out a sample of the video content supported by our sponsors, tweet your support, and keep coming back to SiliconANGLE.
