Sometimes, fear-mongering can have the opposite effect – it makes you feel that you are safe because the people crying wolf seem to have raised the alarm once too often. Then, one day, the wolf really turns up.
Last week, I found a strange thing happening on my wife’s two-week-old Samsung Galaxy Note. There was a notification message that kept popping up sporadically, asking her to join a contest to win an iPad.
It seemed suspicious, but these days, with the endless spam SMSes from property agents in Singapore, you’d think it’s just another piece of spam and to just click on the notification to delete it. Instead, doing so brought me to the browser, which had its homepage changed to a strange-looking search engine.
I sat up immediately. I realised later, from searching up the Internet, that my wife’s phone had been infected by ad-ware, which had probably been hidden in some of the games she downloaded a few days ago.
The tell-tale signs were there. There was a strange search icon on her main screen and most tellingly, the browser’s homepage was changed to a third-party site – a clear case of spammers looking to create traffic for their own sites.
According to security firm Symantec, this was a very common threat that surfaced early this year. It estimated that millions of copies of the spamming software had been downloaded by unwitting users.
Though Symantec eventually downgraded the threat of this Android.Counterclank threat from a trojan to a piece of aggressive ad-ware, the problem remains for users: do you know what you are downloading onto your phones and exposing yourself to?
Although my wife had not downloaded the apps listed as part of the Android.Counterclank scourge, the same spamming software had been adopted by other game developers eager to earn a quick buck from unsuspecting users.
Indeed, of late, there have been a lot more of such adware or malware. A fake version of Instagram, for example, has been spotted this week, following the high-profile buyout of the camera app by Facebook. Once installed, it sends out SMSes to premium rate services without the user’s knowledge.
There’s also a fake version of Angry Birds that lets hackers gain root access to a smartphone and control it much like how “zombie” PCs are controlled after being infected by other trojans.
Notably, these two fake pieces of software are only available in third-party app stores, which means you are likely to catch them more in the wild, than the safer confines of the official Google app store.
In February, Google had responded to a string of malware attacks on Android phones by setting up an automatic scanning process, called Bouncer, that checks if an app uploaded onto its Play store behaves suspiciously.
That’s a good thing to have, but users should always be aware of what they are downloading. Here are a few precautions that you can take:
1. Download from the official app store or a trusted source
2. Download from reputable developers (check how many downloads and apps there have been and read the feedback from users who have downloaded the app)
3. Check the permissions that the app asks for – should a cooking recipe app be asking for permission to send SMSes?
Some security firms also recommend that you download a virus scanner, which looks for suspicious software that have been tagged as malicious. But most of these scanners, compared to their much more sophisticated PC cousins, are still very basic in nature and don’t catch the culprits unless they are already well-known.
So far, we’ve mostly been talking about Android phones. Not surprisingly, the open nature of the operating system and it being the most popular have attracted malware writers.
But iPhone users smiling at this should take note as well. Although Apple claims to check all apps that go on its AppStore, there have been ones that have slipped through, and the company’s response has been far from assuring.
Last year, an iPhone developer found a loophole and slipped an app containing malware into the AppStore, having previously informed the company about it three weeks before. Apple’s response was to ban him. It does not allow any anti-malware scanners on its AppStore, perhaps confident in the belief that the iOS does not need them (see the Mac OS example).
So, the bottomline for smartphone users is to just be careful of what you download. Like on the PC, it’s a matter of keeping abreast of the latest threats and being careful not to end up opening the door to unwanted malware. After all, the most secure systems are often breached by careless users.
In my wife’s case, I decided to clear all the apps, reformat the entire phone and install only the trusted apps. It’s a lesson learnt, that warnings about smartphone malware are no longer just crying wolf. It’s already here.
