Security Alert!! TigerBot SMS Controlled Android Malware

NQ Mobile Security Research Center , in collaboration with researchers of North Carolina State University,  has recently uncovered a new malware named TigerBot. Different from most existing malware controlled through web, this malware is controlled via SMS messages. Based on current analysis, this malware has the built-in payload to execute a variety of commands ranging from uploading current location, sending SMS messages, to even recording phone calls. Also, to hide its existence, this malware chooses not to show any icon on the home screen, but disguises with legitimate app names by pretending to be apps from legitimate vendors such as Google and Adobe. HOW IT WORKS? When TigerBot is being installed, there is no icon on the home screen. When being shown in the installed app list, it displays the same icons with popular apps (e.g., Google's search app) and uses common app names (e.g., "system" or "flash"). By doing so, the malware intends to avoid being noticed by users. In the following, we show an example icon and app name reported in the app list. TigerBot can be remotely controlled by sending SMS messages. In order to receive remote commands, it registers a receiver with a high priority to listen to the intent with action "android.provider.Telephony.SMS_RECEIVED". As a result, it can receive and intercept incoming SMS messages before others with lower priorities. Upon receiving a new SMS message, TigerBot will check whether the message is a specific bot command. If so it will prevent this message from being seen by the users and then execute the command accordingly. Based on current analysis, it supports the following commands: Record the sounds in the phone, including the phone calls, the surrounding sounds and etc. Change the network setting. Upload the current GPS location. Capture and upload the image. Send SMS to a particular number. Reboot the phone. Kill other running processes. analysis shows that some of the above commands may not be perfectly supported. For example, to support the command to remotely reboot the device, it simply broadcasts the intent "android.intent.action.REBOOT". Also, the command to kill other processes may only work on early Android versions. The following screenshot shows the code snippet in TigerBot to reboot the device. TigerBot can be remotely controlled without user's knowledge. To avoid becoming a victim Download applications only from trusted sources. Never accept application requests from unknown sources. and also check developer information before downloading. NQ Mobile Security users are already fully protected from the TigerBot threat. NQ Mobile Security  for Android is available for download at http://www.nq.com/mobilesecurity . Stay Safe.. Hv gr8 day!

puts the internet to work for you. via task 796658