Google said no to the possibility a new wave of pharmacy, penny stock and e-card spam emails are coming from Android spam botnets.
“Our analysis suggests that spammers are using infected computers and a fake mobile signature to try to bypass anti-spam mechanisms in the email platform they’re using,” a Google spokesman said via email in response to security researchers from Microsoft and antivirus firm Sophos who first identified what thought was the handiwork of an Android botnet.
Terry Zink, program manager for Microsoft Forefront Online Security, was the first to report about the spam messages in a blog post last Tuesday, noting all of the emails come from Yahoo’s servers and show they come from Android devices.
“We’ve all heard the rumors, but this is the first time I have seen it — a spammer has control of a botnet that lives on Android devices,” Zink said. “These devices login to the user’s Yahoo Mail account and send spam.”
In a new blog post Thursday, Zink said it is entirely possible the Android Message-IDs from the spam email headers and the “Sent from Yahoo! Mail on Android” taglines ended up added in by Windows malware as part of an elaborate deception to make it appear the spam was coming from Android devices. However, it’s similarly possible these messages appear in this way because they do in fact come from Android devices, he said.
Security researchers from Sophos have also analyzed the spam messages, which advertise generic meds, penny stocks and e-cards, and have arrived at the same conclusion. “The messages appear to originate from compromised Google Android smartphones or tablets,” Sophos senior security advisor Chester Wisniewski said in a Thursday blog post.
The researchers don’t have a copy of the Android malware responsible for this spam campaign, but there is indirect evidence suggesting the emails are coming from Android devices.
The value of the Message-ID field in the email headers mentions “androidMobile” and the messages themselves end with “sent from Yahoo! Mail on Android,” Zink said.
In addition, quite a few of the originating IP addresses, which are present in the email headers, connect to mobile-phone network operators, Wisniewski said.
Based on the IP addresses seen so far, the infected devices are in countries like Ukraine, Russia, Chile, Argentina, Venezuela, Indonesia, Thailand, Philippines, Lebanon, Oman and Saudi Arabia.
It’s not clear how these devices got infected, but the likely scenario is their owners downloaded pirated copies of legitimate commercial apps and those copies also contained malware, Wisniewski said.
The immediate consequence for victims could be a higher mobile phone bill. Sending thousands of spam messages can generate a lot of mobile data traffic and mobile data is not cheap in most countries.
In the past, Android Trojan apps have stolen data, sent SMS messages to premium-rate numbers or displayed unwanted advertisements. However, they have never sent spam before.