Phone-raiding Trojan slips past Apple’s App Store censors

Find And Call is actually Slurp, Stalk And Spam

25 Reg comments Got Tips?

A mobile Trojan that secretly sends the phone's whereabouts and its address book to spammers has slipped into Apple's App Store and Google's Play marketplace.

Called Find And Call, the malware includes a "find your friends" feature that uploads a user's phonebook contents to servers under the control of the application's authors. Victims are not asked to agree to this process, which is not covered either by the program's terms of service nor the end-user licence agreement (EULA), according to security researchers at Kaspersky Lab.

Denis Maslennikov, a senior malware analyst at Kaspersky, reports that the application also logs and uploads a phone's GPS coordinates. Kaspersky began investigating the app following a request by Russian mobile network MegaFon, which initially suspected it was an SMS-sending Trojan.

The Find And Call server sends text messages to numbers lifted from the infected smartphones' contacts lists, encouraging recipients to follow a link and try out the application. This behaviour separates the malware from regular SMS nasties that send spam from the actual handsets.

The app is mostly likely the first piece of malware to make it past Apple's censors and reviewers and onto the App Store in the shop's five years of operation - provided you discount a proof-of-concept program developed and released by white hat hacker Charlie Miller last year.

Malware turning up on Google's official Android software marketplace Google Play is more common due to the store's relaxed rules. The Chocolate Factory released a virus scanner called Bouncer, which is designed to weed out undesirable applications, back in February. By June researchers John Oberheide and (that man again) Charlie Miller had uncovered shortcomings in the detection engine.

Russian blog AppleInsider.ru got in touch with the developers of Find And Call via its tech support. The programmers claimed the SMS-sending feature (which has unsurprisingly drawn a number of complaints) was a bug. The developers are Russian speakers and the app is targeted at the Russian market, but payment for the application is routed via a Singapore-based firm.

Both Apple and Google pulled the application from their respective marketplaces on Thursday. Meanwhile Kaspersky Lab has added detection for both flavours of Find and Call to its mobile security products as Trojan-AndroidOS-Fidall-A and Trojan-iPhoneOS-Fidall-A, respectively. ®

SUBSCRIBE TO OUR WEEKLY TECH NEWSLETTER


Keep Reading

Homeland Security demands a 911 for reporting security holes in federal networks: 'Vulns in internet systems cause real-world impacts'

Great – and who will be the first responders?

Five bag $300,000 in bug bounties after finding 55 security holes in Apple's web apps, IT infrastructure

Unpatched Cisco VPN servers, access to the iOS source code, AWS secret keys – this is weapons grade 'oof'

USA decides to cleanse local networks of anything Chinese under new five-point national data security plan

‘Clean Network’ initiative bans use of Chinese clouds, names Alibaba, Baidu, and Tencent as compromised

The seven deadly sins letting hackers hijack America's govt networks: These unpatched bugs leave systems open

'Unauthorized access to elections support systems' detected tho 'no evidence to date that integrity of elections data has been compromised'

If you haven't potentially exposed 1000s of customers once again with networking vulns, step forward... Not so fast, Palo Alto Networks

Getting to be a real PAN in the OS

Staffer emails compromised and customer details exposed in T-Mobile US's third security whoopsie in as many years

And there it is – exactly what telco was fretting over in FY'19 results

Poor, poor mobile networks. UK's comms watchdog plans to stop 'em selling locked-down handsets

First OTT apps nick their SMS revenue, now this...

UK smacks Huawei with banhammer: Buying firm's 5G gear illegal from year's end, mobile networks ordered to rip out all next-gen kit by 2027

Country to be hit with £2bn cost, massive tech delay after firm 'materially compromised' by latest US sanctions

Biting the hand that feeds IT © 1998–2020