Alternative app marketplaces prove profitable for cybercriminals

Avast researchers discovered a new batch of fake alternative marketplaces for downloading smartphone apps that trick users into sending premium rate SMS messages.

Using a varant of the Android:FakeInst family, the new marketplaces (www.t2file.net, www.uons.net, www.uote.net and www.sofile.net) are aimed at defrauding users looking for smartphone screen savers and games.

“All of these sites were registered just a week ago, so it looks like they were supposed to serve only as a malware platform,” explains Ondrej Vlcek, CTO of AVAST Software, “Accessing these URL’s via a browser generates an error message but using a smart phone prompts the user to install a downloader with a huge range of permissions including the ability to trigger premium rate SMS messages.”

Although the sites target Russian speakers, the fake downloader generates premium rate SMS based on the users country and contains numbers for 60 different countries in an AES encrypted XML file distributed with the application.

Whether the premium rate SMS service providers are complicite in this attempt to defruad smart phone customers is hard to guage. However, Mr. Vlcek belives that Avast! is still the only anti-malware product to detect this new generation of premium SMS scamming applications.

Ondrej Vlcek warns, “Never trust weird looking alternative markets and always check the app permissions. If you’ve downloaded a game or screensaver that asks for SMS and Phone calls permissions, then you are likely to receive an unpleasent surpise in your next phone bill.”