Researchers ID 'smishing' vulnerability in Android

Nov 05, 2012 by Matt Shipman

(Phys.org)—Mobile security researchers have identified a new vulnerability in popular Android platforms, including Gingerbread, Ice Cream Sandwich and Jelly Bean. The vulnerability has been confirmed by Google, and will be addressed in a future Android release.

Specifically, Xuxian Jiang's research team at NC State has identified an SMS-phishing ("smishing") vulnerability. If an Android user downloads an infected app, the attacking program can make it appear that the user has received an SMS, or text, message from someone on the phone's contact list or from trusted banks. This fake message can solicit personal information, such as passwords for user accounts.

"For responsible disclosure, we will not publish the details of the vulnerability until an ultimate fix is out," Jiang says. "However, we think all recent Android phones are vulnerable."

This video is not supported by your browser at this time.

Pending the release of a fix from Google, Jiang says "users are encouraged to be cautious when downloading and installing apps (particularly from unknown sources). As always, it is important to pay close attention to received SMS text messages, in order to avoid being duped by possible phishing attacks."

Explore further: Download woes and HealthKit flaw bite iPhone software

More information: A full write-up from Jiang's team is available here: ttp://www.csc.ncsu.edu/faculty/jiang/smishing.html

Related Stories

Apple says it's fixed iPhone SMS vulnerability

Jul 31, 2009

(AP) -- Apple Inc. says it has fixed an iPhone vulnerability that lets hackers knock people offline - and possibly take over the phones - by sending them specially crafted text messages.

Microsoft engineer eyeballs Android botnet

Jul 04, 2012

(Phys.org) -- A Microsoft engineer has spotted a botnet that targets Yahoo! Mail users using Android devices. Terry Zink , who also writes an Internet security blog, said he has evidence of a botnet running ...

Recommended for you

Hit 'Just Dance' game goes mobile Sept. 25

Sep 18, 2014

Smartphone lovers will get to show off moves almost anywhere with the Sept. 25 release of a free "Just Dance Now" game tuned for mobile Internet lifestyles.

Indie game developers sprouting at Tokyo Game Show

Sep 18, 2014

Nestled among the industry giants at the Tokyo Game Show Thursday are a growing number of small and independent games developers from Asia and Europe, all hoping they are sitting on the next Minecraft.

Review: Ambitious 'Destiny' lacks imagination

Sep 18, 2014

Midway through "Destiny," the new science fiction epic from "Halo" creators Bungie, a smug prince is musing on the hero's desire to visit a mysterious site on Mars.

User comments : 0