Bits Blog: Android Malware Creeps Into Cellphone Bills

Lookout

Smartphones are meant to be headache-free compared with old-school computers. But malicious software written for Android devices can be even sneakier than the malware that invaded PCs.

The most prevalent form of Android malware scrapes small amounts of money from smartphone owners by making secret charges to their phone bills, according to a report published by Lookout, a mobile security company in San Francisco. This type of malware is called toll fraud, and it has the potential to fool plenty of people who don’t pay close attention to their phone bills every month.

But how does toll fraud work if the carriers control our bills? The process is actually very complex, said Derek Halliday, a product manager at Lookout.

First, it helps to understand a legitimate transaction involving text messages. Say, for example, a person wants to send a text message to a service to buy a new ringtone. When this happens, the cellular network forwards the text message to a middleman service, which handles the transaction between the wireless provider and the ringtone provider. The ringtone provider then shoots a message to the cellphone owner asking for confirmation of the order. When the customer confirms the order, he receives the ringtone, his cellphone bill is charged, and the carrier takes a cut and gives the rest of the money to the ringtone provider and the middleman service.

Here’s how toll fraud works: A person downloads a malicious app. The app invisibly sends a text message to a service that uses a middleman service that has a relationship with the malware author. A confirmation message is sent back to the malware, which blocks it from being seen by the customer and confirms the charge. The charge goes to the user’s bill, and the carrier takes its cut and gives the rest of the money to the service and the middleman, and thus the malware author.

In its  report, Lookout estimates that from the beginning of 2012 to the end of 2013, 18 million Android users may encounter malware. About 72 percent of the malware that Lookout detected this year was toll fraud, and the company expects this number to grow, because even though the process is complex, the code isn’t difficult to replicate. The company advised cellphone owners to regularly check their bills for suspicious charges.

Russian Bills Would Increase Control Over Internet and Nonprofits

A series of initiatives have been introduced as President Vladimir V. Putin begins a six-year term, facing an increasingly assertive opposition. The government has imposed draconian fines for people who participate in unsanctioned protests, and legislators voted to reinstitute criminal charges for slander, rolling back a reform adopted seven months ago by Dmitri A. Medvedev, Mr. Putin’s predecessor.

The bills approved on Wednesday would allow the government to block Web sites deemed dangerous to children and require nonprofits to identify themselves as “foreign agents” if they receive financing from outside Russia and are considered by the government to be engaged in political activities.

“In just two months, we have seen a worrying shift in the legislative environment governing the enjoyment of the freedoms of assembly, association, speech and information in the Russian Federation,” said Navi Pillay, the United Nations high commissioner for human rights, in a statement released in Geneva.

The criminalization of slander, she said, could “stifle all criticism of government authorities and limit the ability of individuals to address issues of transparency, corruption and abuse of power.”

“I urge the government of the Russian Federation to avoid taking further steps backward to a more restrictive era,” she added, urging officials to soften the laws passed in recent weeks.

Russia’s Foreign Ministry responded angrily.

“We consider Ms. Pillay’s statement as unbefitting to her status as high commissioner and attempts to publicly accuse the leaders of the Russian state of failing to carry out some kinds of ‘promises’ — as outside the framework of diplomatic ethics,” the ministry said in a statement.

The law on nonprofits — which passed with a vote of 141 to 1, with one abstention — has alarmed a variety of business, charity and religious groups, uncertain whether they will have to carry the label “foreign agent,” a term that invokes cold war espionage. A lawmaker tried to calm those fears in a meeting for nonprofit leaders held by the American Chamber of Commerce, saying the law would be applied only to nonprofits attempting to “change the political system.”

“We understand that events have begun to take place at a faster rate, that the degree of tension in society is growing,” said a United Russia deputy, Aleksandr Petrov, an author of recent amendments to the bill.

“We have one goal: to try, with the help of a number of laws, to create a certain stability, to provide for the integrity of the Russian Federation,” he said. “Yes, there should be political activity, but it should not be allowed to rock the boat which is called Russia.”

Officials have repeatedly suggested that the antigovernment protests of the last six months were financed by foreign governments, and the new law requires nonprofits to deliver detailed accounting to the Ministry of Justice. Mr. Petrov said his suspicions were validated when police seized more than $1 million in cash from a safe in the home of Kseniya Sobchak, a television star and opposition leader. Ms. Sobchak has said the money was her savings.

“According to operative information, which is being discussed now, it was intended to be used for rallies,” he said. “Why must such amounts circulate on the basis of gray schemes? Why can’t this money be officially given to the opposition and show that the money has been given?”

The Internet legislation passed equally swiftly, with a vote of 147 lawmakers in favor, 3 abstaining and none opposed.

Russian Bills Would Increase Control Over Internet and Nonprofits

A series of initiatives have been introduced as President Vladimir V. Putin begins a six-year term, facing an increasingly assertive opposition. The government has imposed draconian fines for people who participate in unsanctioned protests, and legislators voted to reinstitute criminal charges for slander, rolling back a reform adopted seven months ago by Dmitri A. Medvedev, Mr. Putin’s predecessor.

The bills approved on Wednesday would allow the government to block Web sites deemed dangerous to children and require nonprofits to identify themselves as “foreign agents” if they receive financing from outside Russia and are considered by the government to be engaged in political activities.

“In just two months, we have seen a worrying shift in the legislative environment governing the enjoyment of the freedoms of assembly, association, speech and information in the Russian Federation,” said Navi Pillay, the United Nations high commissioner for human rights, in a statement released in Geneva.

The criminalization of slander, she said, could “stifle all criticism of government authorities and limit the ability of individuals to address issues of transparency, corruption and abuse of power.”

“I urge the government of the Russian Federation to avoid taking further steps backward to a more restrictive era,” she added, urging officials to soften the laws passed in recent weeks.

Russia’s Foreign Ministry responded angrily.

“We consider Ms. Pillay’s statement as unbefitting to her status as high commissioner and attempts to publicly accuse the leaders of the Russian state of failing to carry out some kinds of ‘promises’ — as outside the framework of diplomatic ethics,” the ministry said in a statement.

The law on nonprofits — which passed with a vote of 141 to 1, with one abstention — has alarmed a variety of business, charity and religious groups, uncertain whether they will have to carry the label “foreign agent,” a term that invokes cold war espionage. A lawmaker tried to calm those fears in a meeting for nonprofit leaders held by the American Chamber of Commerce, saying the law would be applied only to nonprofits attempting to “change the political system.”

“We understand that events have begun to take place at a faster rate, that the degree of tension in society is growing,” said a United Russia deputy, Aleksandr Petrov, an author of recent amendments to the bill.

“We have one goal: to try, with the help of a number of laws, to create a certain stability, to provide for the integrity of the Russian Federation,” he said. “Yes, there should be political activity, but it should not be allowed to rock the boat which is called Russia.”

Officials have repeatedly suggested that the antigovernment protests of the last six months were financed by foreign governments, and the new law requires nonprofits to deliver detailed accounting to the Ministry of Justice. Mr. Petrov said his suspicions were validated when police seized more than $1 million in cash from a safe in the home of Kseniya Sobchak, a television star and opposition leader. Ms. Sobchak has said the money was her savings.

“According to operative information, which is being discussed now, it was intended to be used for rallies,” he said. “Why must such amounts circulate on the basis of gray schemes? Why can’t this money be officially given to the opposition and show that the money has been given?”

The Internet legislation passed equally swiftly, with a vote of 147 lawmakers in favor, 3 abstaining and none opposed.