Sophos Cloud Optix
Some vendors are calling it HongTouTou, others have named it Adrd, and Sophos (rather unimaginatively in my view!) treats it as a variant of Geinimi, but whatever your anti-virus product chooses to call it, there’s no denying that a new Trojan horse for Android smartphones is making headlines.
The latest Trojan horse for Google’s Android operating system has been seen posing in Chinese third-party app stores as legitimate programs such as Wallpaper apps.
The official Android Market, run by Google, does not appear to be carrying the malicious apps – but if you go “off-road” and choose to install software on your smartphone from elsewhere on the net, then you could be putting your device at risk.
For this reason, the vast majority of Android users probably have little to fear. But those who do install applications from unknown sources (known as “sideloading”) do need to recognise that they might be putting their smartphone, data and potentially finances in danger.
Once installed, the malicious application can not only gather information about your smartphone (the device’s IMEI and IMSI), but it can also emulate clicks on particular search results – giving the visited websites the impression that it is a real mobile phone user choosing to visit their pages.
The assumption has to be that those behind the Trojan horse might be earning commission through the click traffic. Furthermore, of course, it could hurt you in your pocket by eating up data bandwidth.
Interestingly, the malicious code appears to have the ability to download updates for itself via the web, which could contain additional functionality.
Sophos has been detecting the Trojan as a variant of Troj/Geinimi-A since 00:15 BST on 15 February 2011.
For more information about the Trojan, check out the blog entry from the mobile security researchers at Lookout.
Whatever it is called, I call it annoying. More than likely I will be one of those with an issue. That would be just my luck. Interesting bit of work that, that it can connect to the internet all on its own.
Please which website can i get applications that are from a trusted and tested version?
I think you're asking where you should go for "Approved" apps.
The answer is the iTunes Store if you have an Apple iPhone, and the official Android Market if you have an Android smartphone.
Of course, just because something comes from the official store doesn't necessarily mean that it's safe.
For instance, http://nakedsecurity.sophos.com/2010/01/11/bankin…
There were several talks at Shmoocon that covered the whole "if it comes from the Android Market, it's safe" thinking. Definitely Apple has a stricter, and as a result, a more safer market than Android. I hope Google does something about it. Check out the talks by [Georgia Weidman] and [Jon Oberheide and Zach Lanier] at Shmoocon.
Is Sophos planning on entering the mobile security market? I feel naked out there on my Droid… If not, what mobile security product(s) do you recommend?
Yes, you can read the official announcement here:
http://www.sophos.com/pressoffice/news/articles/2…
As smart phones are used more for work, and with the increase of mobile transactions, criminals are obviously moving to target vulnerabilities for example with fake apps. Until the appropriate solution is developed business users need to be educated as to the potential vulnerabilities of accessing confidential information from their mobiles.