# MA-425.112014: MyCERT Alert - Mobile Botnet Targeting Malaysian Smartphone Users

**Date:** 03 Nov 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-425.112014  
**Advisory ID:** MA-425.112014

---

**1.0 Introduction**
MyCERT received a report from our foreign counterpart regarding a mobile botnet that spreads malware via SMS messages. Android  smartphone users who clicked on the link in the SMS message, inadvertantly installed a  malicious Android Package (APK) that took control of their mobile phone.
The infected smartphones can be hijacked remotely and potentially used for fraudulent purposes such as buying digital goods and services. The smartphones can also be used for spreading the malware to more smartphones by sending SMS with link to malicious APK.
**2.0 Affected Systems**
Based on the information received, the below is the affected system:
2.1 Smartphone running on Android
**3.0 Impact**
3.1 Cybercriminal or botnet herders directed the infected smartphones to buy digital goods from Micropayment providers in Malaysia..
3.2 The malware will SMS to other smartphone users, extracted from the phone address book,  a malicious APK and infect the other smartphones.
3.3 Phone numbers extracted from the infected smartphones are stolen and can be used for malicious activities by perpetrators.
**4.0 Recommendation**
As best practice to safeguard smartphones, smartphone users are advised:
1. Set a password for  your smart phone. All of the major smartphone operating systems allow you to set a password and automatically lock your phone after a period of inactivity.
2. Verify an app's permission and the app's author or publisher before installing it.
3. Do not click on adware or suspicious URL sent through SMS/messaging services. Malicious program could be attached to collect user's information.
4. Always run a reputable anti-virus on your smartphone/mobile devices, and keep it up to date regularly.
> Some examples are:
>
> AVG:
> <http://www.avg.com/us-en/antivirus-for-android?cmpid=ws_droid_banner_us_1>
>
> F-Secure
> <http://www.f-secure.com/en/web/home_global/mobile-security?p_p_id=56_INSTANCE_39Vy&p_p_lifecycle=1&p_p_state=maximized&p_p_col_id=column-3&p_p_col_pos=1&p_p_col_count=2>
>
> Trendmicro
> <http://housecall.trendmicro.com/us/mobile/>
5. Switch off Bluetooth if it is not in use
If you’re not using your Bluetooth connection, it is best to switch it off. That way, you’ll make your phone less vulnerable to attacks.
6. If your smartphone is found to be infected with a malware, it is best to Reset the smartphone.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone: 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Cyber999 Mobile Apps: Download at Google Play or Apps Store
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
**5.0 References**
5.1 <http://media.kaspersky.com/pdf/KSB_2013_EN.pdf>
5.2. <http://www.twncert.org.tw>
5.3 <http://usa.kaspersky.com/internet-security-center/internet-safety/smartphones#.VFbVpIZlbpc>