The Latest in IT Security

New Year’s Wishes – with side order of data harvesting

29
Dec
2011

It’s almost end 2011. What with Christmas recently passed, and New Year coming up, there’s naturally a lot of well wishes and holiday greetings being messaged around. Looks like someone’s decided to join in (a little late) – and also do a bit of data harvesting at the same time.

Spyware:Android/AdBoo.A appears to be one of those programs that lets you send witty/sweet/funny messages to your contacts. On execution, it displays a list of text messages that fall into different categories: new year wishes, friendship, love and jokes:

trojan_android_adboo_text (240k image)

When the user choose one of these messages, the app prompts a dialog box asking the user to choose the next action: Contact, Edit or Cancel:

trojan_android_adboo_msg (179k image)

If the Contact option is chosen, the app tries to read the stored contact data. Presumably, the app needs to know who to send the message to:

trojan_android_adboo_choices (91k image)

During our initial analysis, since the test phone used didn’t have any contacts stored in it, the app didn’t retrieve anything at this point.

However, when retested with (bogus) contacts present, no text message is sent either – the user only sees a dialog box with the message “Sending fail”:

trojan_android_adboo_sendfailed (24k image)

We noticed that the app did do something else though. On chosing the Contacts options, it silently obtained the following information from the device:

1) Phone Model
2) Android Version
3) Phone number
4) International Mobile Equipment Identity (IMEI) number

The harvested details are then forwarded to remote server.

Incidentally, looking at the certificate for the Adboo sample we have, it appears to be from the same developer as Trojan:Android/Zsone.A:

Adboo:

adboo_sha1 (25k image)

Zsone:

zsone_sha1 (26k image)

ThreatSolutions post by – Irene

Leave a reply


Categories

TUESDAY, DECEMBER 10, 2019
WHITE PAPERS

Mission-Critical Broadband – Why Governments Should Partner with Commercial Operators:
Many governments embrace mobile network operator (MNO) networks as ...

ARA at Scale: How to Choose a Solution That Grows With Your Needs:
Application release automation (ARA) tools enable best practices in...

The Multi-Model Database:
Part of the “new normal” where data and cloud applications are ...

Featured

Archives

Latest Comments