June 23, 2006

According to Internet security company Websense Security Labs, Internet users are being duped into downloading a destructive Trojan bot by text messaging applications. Websense says it has received numerous reports of users getting a text message on their cell or mobile phones. The message thanks them for subscribing to a bogus online dating service.

The message states that the subscription fee of $2 per day will be automatically charged to their mobile phone bill until their subscription is cancelled at the online site.

The same message is also being spammed to the comments section of numerous message boards.

Users who visit the site to unsubscribe from the service are prompted to download a variant of the Dumador Trojan bot.

The original Dumador.BC is a backdoor Trojan that allows the computer to be remotely controlled, as it opens two TCP ports and receives remote commands by making GET requests to two different web addresses.

It also logs certain information in a file, and prevents users from accessing several websites, mainly belonging to anti-virus companies.

The site does not attempt to exploit any vulnerabilities; instead, the attacker provides instructions to the user on how to bypass the Internet Explorer security warning prompt.

"We're seeing the next evolution of blended threats exploiting a new attack vector - SMS over a mobile phone. There has been much talk of security risks associated with mobiles for years and they are now becoming reality," said Mark Murtagh, technical services director for Websense.

"As mobiles have become an essential part of our everyday lives, they are an extremely attractive lure for criminals who want to exploit their huge user base.

"The concern of a $2 a day charge is enough to make even the least PC-savvy person take action to ensure they have 'unsubscribed' - and thus, unwittingly get tricked into downloading malicious code.

"Using a web security solution is the first line of defence, but this particular incident shows just how difficult it is to prevent such a sophisticated socially engineered attack using both the mobile network and the web," he added.

Source: Vnunet

Save Internet Security.ca's URL to the list of your favorite web sites in your Web browser by clicking here.

Become an authorized reseller of Proxy Sentinel™ and Firewall Sentinel™. Do like the rest of our authorized resellers and have your clients benefit the important security features of our products and solutions, while increasing your sales at the same time. Click here for all the details.

You can link to the Internet Security web site as much as you like. Read our section on how your company can participate in our reciprocal link exchange program and increase your rankings in the major search engines such as
Google and all the others.