Android applications that can spoof SMS messages, potentially for scam campaigns, have been downloaded by millions, according to security firm Symantec.
The vendor said it had recorded 200 available applications on the official Google Play market, although some only contain the SMS spoofing code to “better integrate text messaging with instant messaging or other online services”.
“Users should … be wary of the source of any suspicious incoming text messages while Google modifies Android to prevent spoofing of these text messages,” Symantec said in a blog post.
“However, we have not yet found any instances that use the code for an SMSishing attack. Instead, the vast majority of apps use the code to deliver advertisements, including a couple hundred applications hosted on Google Play.”
Despite Symantec’s note of caution on SMSishing scares, many are concerned about the ability for apps to push texts to users without actually sending the message across a network. Instead, the apps manipulate the phone to make it appear.
As shown by researchers from North Carolina State University last week, it is possible for apps to access users’ address books to make it appear as though the text comes from a contact. That’s ideal for SMSishing campaigns which seek to make malicious messages appear legitimate.
Researchers claimed there was a vulnerability in Android. They said it meant an exploiting app did not have to request any permission to launch a SMSishing attack.
According to the team, Google is working on a fix for the flaw for the next release of Android.
Are you a security pro? Try our quiz!
Tesla retreats from pioneering gigacasting manufacturing process, amid cost cutting and challenges at EV giant
No skynet please. After the US, UK and France pledge human only control of nuclear…
Microsoft's AI investments continue in south east Asia, after investments in Japan, Malaysia, Indonesia, as…
New chapter for LastPass as it becomes an independent company to focus on cybersecurity, after…
US FCC seeks to ban Chinese telecom firms at centre of national security concerns from…
Two updates to Anthropic's AI chatbot Claude sees arrival of a new business-focused plan, as…