People are being conned into downloading a Trojan bot by text message
according to security firm Websense Security Labs.
The
company has received reports of people receiving a text message on their
mobile phone, thanking them for subscribing to a fictitious dating service.
The message states that the subscription fee of $2 per day will be
automatically charged to their mobile phone bill until their subscription is
cancelled at the online site.
The same message is also being spammed to the comments section of numerous
message boards.
Users who visit the site to unsubscribe from the service are prompted to
download a variant of the Dumador Trojan
bot.
The
original Dumador.BC is a backdoor
Trojan
that allows the computer to be remotely controlled, as it opens two TCP ports
and receives remote commands by making GET requests to two different web
addresses.
It also logs certain information in a file, and prevents users from accessing
several websites, mainly belonging to anti-virus companies.
The site does not attempt to exploit any vulnerabilities; instead, the
attacker provides instructions to the user on how to bypass the Internet
Explorer security warning prompt.
"We're seeing the next evolution of blended threats exploiting a new attack
vector - SMS over a mobile phone. There has been much talk of security risks
associated with mobiles for years and they are now becoming reality," said Mark
Murtagh, technical services director for Websense.
"As mobiles have become an essential part of our everyday lives, they are an
extremely attractive lure for criminals who want to exploit their huge user
base.
"The concern of a $2 a day charge is enough to make even the least PC-savvy
person take action to ensure they have 'unsubscribed' - and thus, unwittingly
get tricked into downloading malicious code.
"Using a web security solution is the first line of defence, but this
particular incident shows just how difficult it is to prevent such a
sophisticated socially engineered attack using both the mobile network and the
web," he added.
Reader comments