mobile phones

Some time ago, I bumped into a few Android applications which use Airpush. Airpush is an advertisement SDK developers can add to their application to generate some revenue: for every thousand ads displayed via their application, the developers gets a few dollars in return. In the case of Airpush, the ads are pushed in the mobile phone's system tray, i.e they do not appear in the application itself, but generally at system level. The ads stand higher chances of being read/clicked on, but many end-users complained this system was really too intrusive. See... [Read More]
by RSS Axelle Apvrille  |  May 17, 2011  |  Filed in: Security Research
Android devices continue to be the target of malware authors with Android/Fake10086.A!tr. AegisLab spotted this malicious Trojan in the wild in China and posted an interesting write-up on the matter. In brief, Android/Fake10086.A!tr looks like a handy hotel reservation application (e.g com.hotel apk), but in the background it communicates with a remote web server and blocks some incoming SMS messages. Most noticeably, Fake10086 blocks SMS messages coming from 10086, the customer service portal of a leading chinese telecom operator - presumably... [Read More]
by RSS Axelle Apvrille  |  Mar 10, 2011  |  Filed in: Security Research
While wearing my eyes off on the assembly code of the Symbian malware Zitmo, I had been quite embarrassed not to find any clear link with stealing online banking credentials as the rest of the ZeuS attack seemed to indicate. This issue is now solved, I know how the cyber-criminals did it or intended to. The Zitmo malware is actually a light version (or a cracked one) of the Russian SMS Monitor application. This borderline application is officially meant for "parental control" and "security audit", but it looks like it ended upin the wrong hands... We... [Read More]
by RSS Axelle Apvrille  |  Sep 28, 2010  |  Filed in: Security Research
Lately, I have been analyzing a sample of SymbOS/Album.A!tr, another advanced malware targeting mobile phones running Symbian OS 9 and greater. First of all, once more, like SymbOS/Yxes, this malware was "legitimately" signed by Symbian's Express Signed program. The certificate is now revoked: Serial Number: c8:8e:00:01:00:23:db:45:38:bc:e7:2a:d3:03 Signature Algorithm: sha1WithRSAEncryption Issuer: C=GB, O=Symbian Limited, CN=Symbian CA I Validity Not Before: Nov 20 05:00:02 2009 GMT Not After : Nov 21 05:00:02 2019 GMT Subject: C=CN,... [Read More]
by RSS Axelle Apvrille  |  Jul 08, 2010  |  Filed in: Security Research
Some time ago, we came across a new Windows Mobile Trojan dialer named WinCE/Terdial!tr.dial. Under the cover of a FPS game (Antiterrorist 3D) or a Windows Mobile codec package (, this Trojan actually has the victim's phone call international premium rate phone numbers (IPRN), i.e phone numbers for which a given service is provided and, of course, higher prices are charged ;). More information is available in our Virus Encyclopedia, or just search the web for numerous alerts on the matter. On my side, I have been playing Sherlock... [Read More]
by RSS Axelle Apvrille  |  May 17, 2010  |  Filed in: Security Research