Kaspersky Lab has uncovered a set of malicious Android
applications posing
as security software.

The malware is linked to the infamous Zeus Trojan, a common
tool used in the theft of banking credentials. The phony security applications
were first observed earlier this month, and newer versions have continued to
appear, according to Kaspersky.

“On the 4th of June 2012 we found 3 APK files of ~207
kb in size each heuristically detected by our engine as
HEUR:Trojan-Spy.AndroidOS.Zitmo.a,” blogged Kaspersky researcher Denis
Maslennikov.  “All these
applications are malicious and were created to steal incoming SMS messages from
infected devices. SMS messages will be uploaded to a remote server whose URL is
encrypted and stored inside the body of the Trojan.”

The company found three more APK (application package) files
with exactly the same functionality on the June 8, 13 and 14. All totaled,
there are at least six files that pretend to be “Android Security Suite Premium,”
but in actuality steal incoming SMS messages, the researcher said. The point of
stealing incoming SMS messages is to swipe the victim’s mobile transaction
authentication number (mTAN), which is used by banks to authenticate online
bank transactions. When a device is infected, the SMS messages are uploaded to
a remote server.

“One of the remote server domains was registered using
the same fake data which was used for registering ZeuS CCs [command and
control] servers back in 2011,” Maslennikov blogged.” And the
malware’s functionality is almost the same as in old ZitMo samples [the mobile
version of Zeus]. Therefore ‘Android Security Suite Premium’ = New ZitMo.”

The issue of Android malware has been a focus security
researchers and attackers alike for the past year.  Last week, Sophos released its list of the
five most common pieces of Android malware. The most prevalent is what the
company refers to as Andr/PJApps-C, which Sophos Senior Technology Consultant
Graham Cluley described as an application that has been cracked using a
publicly available tool that may or may not be actually malicious. The second
most popular is BaseBridge, which uses a privilege escalation exploit to
elevate its privileges and install additional malicious apps onto a victim’s
device. It also uses HTTP to communicate with a central server and leaks
potentially identifiable information.

On June 13, authorities in Japan arrested six men for
distributing a malicious Android app through a Website that hosted adult
content. According to The Daily Yomiuri,
the Trojan was hidden inside an application that posed as a video player. Once
opened, the malware stole the victim’s information and sent it to a remote
server. The application also displayed a message demanding a payment of 99,800
yen. Symantec detects the rogue application as Android.Oneclickfraud.

“While there are countless numbers of sites aimed at
scamming computer users, there have only been a handful of sites designed for
smartphones to date,” blogged
Joji Hamada, threat analyst with Symantec Security Response. “Out of
those, we are aware of at least two sites affiliated with the site operated by
the arrested men, and they are up and running…. So, with the arrest of the gang
operating Android.Oneclickfraud I am hopeful that their sister sites will be
taken down soon, with more arrests to follow. However, at the time of writing
they show no sign of letting up.”

Article source: http://feeds.ziffdavisenterprise.com/~r/RSS/eweeksecurity/~3/lRLWx29K7DU/