Android's rite of passage: Now it has a botnet

The spread of Android malware may have hit a new milestone recently, with the discovery of what could be the first botnet operating on smart phones, in this case smart phones running the Android operating system.

Microsoft security researcher Terry Zink wrote in a July 3 blog post that he came across spam samples from compromised Yahoo accounts that all included a message ID showing that they came from Android devices. And they all ended with the tagline: “Sent from Yahoo! Mail on Android.”

“We’ve all heard the rumors, but this is the first time I have seen it -- a spammer has control of a botnet that lives on Android devices,” Zink wrote. Infected devices will send spam from the user’s Yahoo mail account.


Related stories:

Android, Mac malware on rise, and beware mom-and-pop websites

DOD’s move to Android started with DARPA apps program


UPDATE: Since this story was published, Google issued a statement saying that the botnet is not running on Android devices and that the message ID is being spoofed to make it appear so, according to IDG News Service. Meanwhile, Sophos researchers say the spam does appear to be coming from Android smart phones and tablets, while BitDefender and Kaspersky Labs researchers say the evidence is not conclusive one way or the other, IDG reported.


The existence of smart-phone botnets could be a concern for government agencies that are incorporating Android and other mobile platforms into their enterprises, although this particular botnet likely wouldn’t affect an organization that manages the apps on its phones or sets rules for employees taking a “bring your own device” approach to work.

Zink said the messages he found come from IP addresses in Chile, Indonesia, Lebanon, Oman, Philippines, Russia, Saudi Arabia, Thailand, Ukraine and Venezuela, which could be an indication that the botnet is spreading through malware in a third-party app users have downloaded on the cheap.

Users in the developing world tend to be more lax about security than those in developed countries, and they are more likely to acquire a smart-phone app “from some guy in a back alley on the Internet,” increasing the chances of getting malware along with it, he wrote.

“I am betting that the users of those phones downloaded some malicious Android app in order to avoid paying for a legitimate version, and they got more than they bargained for,” Zink wrote. “Either that or they acquired a rogue Yahoo Mail app.”

Botnets have been a scourge of PCs for years, but as users and organization have moved to mobile platforms, spammers, phishers and other cyber attackers have followed. In the last year, the number of malware samples for mobile devices has quadrupled, according to McAfee’s quarterly Threat Report, released in May.

But whether you’re using a PC or a smart phone, the standard advice for avoiding getting hooked into a botnet is the same: regularly update your device with the latest patches and security upgrades; keep current with the latest browser versions, and be very careful about the links you click on.

If you receive a link that is at all suspicious, it would be better to type the URL into your browser than clicking on what could be a spoofed link, for instance. Or if someone sends you a link to a story on a news site or a product page for a company, you could go on your own to the site’s home page and look for the story or product from there.

And, of course, if your agency has rules for using mobile devices, it’s best to stay within the lines.

About the Author

Kevin McCaney is editor of Defense Systems. Follow him on Twitter: @KevinMcCaney.

Reader Comments

Fri, Jul 6, 2012 SoutheastUS

Android botnets: maybe they are real right now, maybe not. However, it is possible to do given enough knowledge about Android and the various flavors of kernels in the many smartphones and tablets. As to Microsoft, there is much speculation about why there continues to be security issues with Windows variants. It could be that maintaining some compatibility with older applications has hampered the elimination of the weak code from the systems. Desktop and laptop systems are powerful enough, now, that MS should do away with 32-bit systems altogether and run "compatibility sandboxes" for legacy software that prevents compromise to the OS and the host hardware so malware never gets a foothold.

Fri, Jul 6, 2012 dave Washington DC

Microsoft FUD! I am surprised that Microsoft didn't go through their regular proxies to make this announcement. By the way, why do you publish these unsubstantiated rumors? It really reflects poorly on your credibility when you quote Microsoft on anything about security... after all it has been 23 years since the Friday the 13th virus and they still have not fixed security in any of their operating system variants!

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above