Botnet spam financial risk for cellphone owners says authority

Stan Beer
Thursday, 25 May 2006 19:19

Your IT - Mobility

One of world’s leading anti-virus experts says mobile phone users are at risk of being unjustly slapped with massive phone bills because of rogue botnet SMS spammers. Botnets are networks of PCs or phones that have been hijacked without the knowledge of their owners.

Mikko Hypponen, director of anti-virus research at Finnish-based F-Secure Corp, led the team that infiltrated the Slapper worm attack network in 2002, took down the world-wide network used by the Sobig.F worm in 2003 and was the first to warn the world about the Sasser outbreak in 2004.

Hyponnen believes that mobile phones are the next fertile territory for cyber criminals to harvest millions from unsuspecting cellphone users by taking control of their phones without the knowledge of owners and using their stored numbers to send SMS spam. Once a botnet spammer has control of a phone, as is the case with PCs, they can unwittingly become part of a global network, with each phone potentially sending millions of SMS spam messages.

“If you look at the techniques that are being used to make money with viruses, there are a couple,” says Hyponnen. “The first one which we started seeing about four years ago is spamming. Most of the spam today is being fed from botnets created by viruses.

“What makes botnets really a risk is that you can a network of tens of thousands of individual machines located all over the world under the command of one person. With that amount of computing power, you can do pretty much anything, including sending spam.”

According to Hyponnen, mobile phone malware is just around the corner and the former inhibiting factor of the cost of sending SMS messages will no longer be a deterrent to spammers.

“Pretty soon now I’m afraid we will start to see mobile phone malware infecting phones and then starting to send SMS messages to all the mobile phone numbers listed in the phonebooks of phones,” Hyponnen. “That way the spammers can move the charges away from themselves to you and they also get access to the list in your phonebook. We haven’t seen this yet but do you think it won’t happen?”

According to Hyponnen, before too long mobile phone users will be forced to implement similar security measures as PC users.

“Right now, there are a little over 200 mobile phone viruses so it’s still very early days. We found the first mobile phone Trojan just six weeks ago which works by sending SMS messages from the infected phones to a premium rate number which is owned by the virus writer, where each SMS message costs around 5 Euros. The virus writer is in Russia and it is only targeting Russian phones but it is a very clear sign of things to come.”

Hyponnen says that in future anti-virus products for phones will be mandatory as they are for computers today.