Spammers released a do it yourself (DIY) mobile phone number harvesting tool, but instead of advertising just on underground online sites, they are also marketing it across the web.
The availability of the utility turns the simple act of submitting a mobile number to a website something that might lead to the receipt of more SMS (text message) spam, said a researcher at Webroot.
A new version of the phone number harvesting tool crawls the web and indexes mobile numbers, phone ID numbers, the names of the owner, and the associated mobile operator, among other information. Users of the tool can choose which country they want to target.
The harvested information can end up used for malicious and fraudulent purposes.
Key features of the tool include automatic recognition of Russian and Ukrainian mobile phone providers (based on its initial target market), indexing based on a region and city for Russia and Ukraine, multi-threaded software allowing up to 100 “indexing streams,” as well as an option to collect only numbers attached to a particular mobile provider.
“Cybercriminals and spammers are not strangers to the concept of market segmentation,” said Dancho Danchev, a security researcher at Webroot.
“Just like true marketers, the developer of the tool has included the option to choose a specific region within the available countries, with the idea to assist in the inevitable malicious and fraudulent activity that will result from this phone number harvesting activity,” he said.
Danchev said web users should double-check whether any website that requests your phone number is actually listing it on the web. The phone number harvesting tool has yet to crawl through sites that require authorization or spread outside Russia and the Ukraine, he said, but future versions will most likely expand indexing capabilities and geographical reach, Danchev said.
The DIY phone number harvesting tool is an example of a wider trend of selling tools once exclusively available to sophisticated cybercriminals to less elite bad guys though underground forums. Services that offer a means to launch managed SMS flooding and phone ring flooding have recently become available through these forums. Both managed SMS flooding and phone ring flooding are pitched as a means to “take care of your competitor’s phone lines” or a DDoS attack on phones instead of websites. However, these services might easily lend themselves to helping along more ambitious scams, such as flooding out a bank’s call centers to prevent early reports of card fraud cash-out operations, Webroot said.
“By starting to advertise these very same malicious (DIY) tools and services on publicly accessible forums, they’re proving that they’re willing to sacrifice a certain degree of OPSEC (Operational Security) for the sake of growing their business model and attracting new customers,” Danchev said.