# MA-436.122014: MyCERT Alert - Circulation of a Malicious SMS

**Date:** 23 Dec 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-436.122014  
**Advisory ID:** MA-436.122014

---

#### **1.0    Introduction**
MYCERT has received reports of individuals receiving an SMS from their contacts. Android smartphone users who clicked on the link within the SMS message, inadvertently installed a malicious Android Package (APK) that took control of their mobile phone. The smartphones is used for spreading the SMS message to more users in the contact list.
The SMS contains a questionnaire statement and a URL. The content structure of the SMS is as per below:
> (Name) Is this your photo?
> (Shortened link)
**Figure 1**: An example snapshot of the SMS attack
**Figure 2**: PhotoViewer app requesting for installation
**Figure 3**: Permission to send SMS messages
**Figure 4**: Some of the advertisement that appears
**Figure 5**: Advertisements pops out on the device screen
**Figure 6**: Remove the tick at the “Unknown sources” checkbox.
**2.0    Systems Affected**
Smartphones with Android Operating System
**3.0    Recommendation**
As best practice to safeguard smartphones, users are advised:
>  1. If a user's phone has been infected, uninstall the PhotoViewer app from the infected phones and delete the Android Application Package (APK) file from the Downloads folder, which could be accessed from the browser’s settings page.
>
> 2. Do not respond to the SMS or click the URL attached in the SMS. It is advised that users report the SMS received immediately to Cyber999 for our analysis and further action.
>
> 3. Set a password for your smart phone. All of the major smartphone operating systems allow you to set a password and automatically lock your phone after a period of inactivity.
>
> 4. Verify an app's permission and the app's author or publisher before installing it, unless you really know the reputation of the app provider. Referring to Figure 6, untick the checkbox for “Unknown sources”.
>
> 5. Do not click on adware or suspicious URL sent through SMS/messaging services. Malicious program could be attached to collect user's information.
>
> 6. Always run a reputable anti-virus on your smartphone/mobile devices, and keep it up to date regularly.
> Some examples are:
>
> AVG:
> <http://www.avg.com/us-en/antivirus-for-android?cmpid=ws_droid_banner_us_1>
>
> F-Secure
> <http://www.f-secure.com/en/web/home_global/mobile-security?p_p_id=56_INSTANCE_39Vy&p_p_lifecycle=1&p_p_state=maximized&p_p_col_id=column-3&p_p_col_pos=1&p_p_col_count=2>
>
> Trendmicro
> <http://housecall.trendmicro.com/us/mobile/>
>
> 7. Switch off Bluetooth if it is not in use. If you’re not using your Bluetooth connection, it is best to switch it off. That way, you’ll make your phone less vulnerable to attacks.
>
> 8. If your smartphone is found to be infected with a malware, it is best to Reset the smartphone and immediately install reputable antivirus software to protect and secure your devices.
>
> 9. Always  verify the authenticity of the source of software/installer/apk before installation. Avoid 3rd party installer or APK based installer unless the authenticity or reputation of the provider is known.
MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone: 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**3.0    References**
- SingCERT: Malicious SMS, <https://www.singcert.org.sg/alerts/21-latest/634-singcert-malicious-sms>
- PSA: “Is this your photo?” SMS virus circulating, <http://www.hardwarezone.com.sg/tech-news-psa-your-photo-sms-virus-circulating>
- “Is this your photo?” SMS virus circulating in Singapore, <http://digital.asiaone.com/digital/news/sms-virus-circulating-singapore>