Microsoft Engineer Discovers Android Spam Botnet, Google Denies Claim 152
An anonymous reader writes "Microsoft engineer Terry Zink has discovered Android devices are being used to send spam. He has identified an international Android botnet and outlined the details on his MSDN blog. A closer look at the e-mails' header information shows all the messages come from compromised Yahoo accounts. Furthermore, they are also stamped with the 'Sent from Yahoo! Mail on Android' signature. Google has denied the allegations. 'The evidence does not support the Android botnet claim,' a Google spokesperson said in a statement. 'Our analysis suggests that spammers are using infected computers and a fake mobile signature to try to bypass anti-spam mechanisms in the email platform they're using.'"
Why not? (Score:5, Interesting)
This seems like a much easier way to send spam... Most users will be using the stock mail app so just install, ask for the world in privileges (most users just click yes to anything), then send spam in the background using the user's account.
If you are smart, you avoid sending any spam to that user's contacts and intercept any replies that contain the spam text as a quoted string. That would make it far less likely for the victim to notice anytime soon.
Even if the spam isn't coming from Android phones right now, I'm sure someone will do it eventually.
Re:Just link to the ACTUAL blog entry (Score:4, Interesting)
Fascinating conclusion he's come to. It looks like MS engineers don't understand Joe jobs.
Is the Message-ID incrementing? (Score:4, Interesting)
And if so does it match the generation scheme used by Android.
If it's a repeating "Message-ID: " as the blog suggests then it's likely forged.
Is it just Yahoo? (Score:5, Interesting)
I see emails from compromised accounts. The one thing that appears to be common is that it is always from Yahoo accounts. After one of my friends had her Yahoo account compromised, I throughly scanned her PC -- nothing showed up. I scanned the hard drive while connected to a known clean PC, so it wasn't just a well hidden malware.
I am beginning to wonder if there is a vulnerability in Yahoo's security that is being used to compromise accounts.
Re:A Microsoft engineer? (Score:1, Interesting)
That was largely my thought, Android devices lack the processing power and access to bandwidth that your average laptop or desktop has. While I'm sure it's technically possible to have an Android spam botnet, it really begs the question as to why anybody would bother to develop such a thing. Considering how unreliable the connects are and how little you can transmit combined with the increased difficulty of getting the code to run, it doesn't seem like something that would be profitable enough to justify making at this point.
Re:Is it just Yahoo? (Score:5, Interesting)
Her account had to be compromised somehow. The emails were sent using her credentials. Her Yahoo mailbox was modified to delete all the saved emails and contacts, change the password and forward the email elsewhere. It was not simply someone sending email that looked like it came from her account -- it really was sent using her Yahoo account.
She told me that she only checks her email from her PC, at home. She doesn't use open-Wifi points, she doesn't use other PCs. Unless there was some kind of malware the vaporized itself from her PC after stealing her account credentials, or [contrary to what she told me] she really did use another PC to check here email the limited evidence suggest that her account credentials were stolen by a security flaw at Yahoo.
Re:Is it just Yahoo? (Score:5, Interesting)
The answer is a Firefox exploit with an invisible iFrame. I have seen it myself and Hairyfeet noticed the same thing if you browse some porn sites with Firefox after you log in your account will randomly start spamming people.
Basically it is an iframe rogue ad which looks identical to the yahoo email login and it uses javascript to place it over the real yahoo login from yahoo.com. Since the iframe is invisible in Firefox you have no clue and just click on it and give in the username and password.
I wonder if Mozilla fixed this?
Re:Redmond Help Wanted (Score:3, Interesting)
FWIW, I see far more frivolous lawsuits from Apple these days than from Microsoft. In fact, when was the last time we talked about a Microsoft lawsuit?
Comment removed (Score:5, Interesting)