China's Android users warned of giant botnet
One million infected by MKD Trojan, and counting
Agentless Backup is Not a Myth
Security researchers in China are warning Android users to be on their guard after claiming to have discovered a million-strong botnet lurking on the platform.
The Android.Troj.mdk Trojan, first spotted by security firm Kingsoft Duba back in early 2011, is thought to be hidden in over 7,000 apps today, including many popular games such as Fishing Joy and Temple Run.
Once installed it allows the attacker to remotely control the victim’s smartphone for a variety of nefarious ends including harvesting contact and messaging details, generating nuisance adware, committing click fraud and downloading additional apps, Xinhua reported.
The million-node-plus botnet represents a small proportion of the 150 million users of Android phones in China today, but its relative success thus far points to a worrying lack of user awareness around the dangers of downloading apps from unofficial third party stores.
Aside from installing mobile security software, China is urging users to keep an eye on their call history and data traffic and to beware of any gaming apps seeking unusual permissions, such as access to SMS or other content, according to Xinhua.
China has been a hotbed of Android malware for several years. Last year the government was even forced to publicly reprimand operators China Mobile and China Telecom for persistently allowing security vulnerabilities in their application stores. ®
COMMENTS
No. It's the Achilles Heel of installing dodgy software from nefarious sources on your devices [although granted, Android does make this easier to do than oher phone OSes]
This is why
Android should let users block any apps they want from network access.
I hear you say: "yes but poor developers need ads revenue to survive and apps need network access to fetch ads". Fine. Provide an API which allows apps to fetch ads in a [i]controlled[/i] manner.
I mean, this is not paranoia. There [i]are[/i] people out to get you. It is now standard on non-mobile machines to get a warning whenever a program accesses the web for the first time, giving you the choice to block it. I see no reason why it should not be the case for phones.
Re: This is why
> There [i]are[/i] people out to get you. It is now standard on non-mobile machines to get a warning whenever a program accesses the web for the first time, giving you the choice to block it
Oh sure, asking users to click yes to get the free stuff they want has really proven to be an effective security model. Numerous studies have shown that unless the box says "this app is going to steal your stuff" most users will just click yes because they think it is needed to play the game/app. The spread of the first Symbian worm required the user to click yes to:
* Do you wish to accept a bluetooth connection from an unknown device
* Do you wish to accept a file from <<device>
* Do you wish to execute file from <device>
No user in their right mind would click yes to any of one of those, but there were still some who clicked yes to all three. The average user does not have sufficient knowledge to make informed consent, so this method doesn't work.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
