'Money sucking' phones in China spur government action

China's government warns of handsets installed with software that secretly spends users money

By Michael Kan, IDG News Service |  Security Add a new comment

Mobile phones in China installed with malware that secretly rake up user fees has spurred the Chinese government to crack down on the illegal activity.

China's Ministry of Industry and Information Technology issued a notice on Wednesday that declared government agencies and the country's telecom operators were implementing new measures to tackle the still serious problem.

The ministry is targeting what it called "money sucking" phones, which are installed with software that triggers fee-based mobile services without users' knowledge.

The phones with the problem are brand name knock-offs built using the Android operating system, said Zhao Wei, CEO of Chinese security company Knownsec. Each month, the phones will spend only about 2 yuan (US$0.30) in text messages or other mobile services. The small amount ensures that users will not take notice, he said.

The makers of the phones are the ones responsible for installing the malware, and do so in order to generate more revenue, Zhao added. The phones make money by accessing mobile services operated or linked to the handset maker, he said.

"I think the software industry lacks a better business model, they can only make these knock-off and money-sucking software in order to survive," he said. "This is fast becoming an industry in itself."

The ministry has been already been fighting the problem and said it has contained it to some extent, according to the notice, which was written at the end of December.

The new measures include China's telecom operators making efforts to boost supervision of their mobile services to check for irregularities. The ministry will also step up inspection for handset product quality, while also strictly regulating built-in software for the devices.

China has been seeing more malware used on mobile phones, say those working in China's IT security field. In November, the Chinese media reported on a "zombie" virus that infected handsets and sent out random text messages at the expense of users' accounts.

As smartphone use grows in the country, more of these devices are also being used to access the Internet, said Adrian Liu, a staff member with China's National Computer Network Emergency Response Technical Team. "Traditional security threats that exist on the Internet are spreading to mobile handsets, so we must prepare for them in advance," he said in an e-mail.

ITworld LIVE

SecurityWhite Papers & Webcasts

Webcast On Demand

Seven Deadly Sins of Cloud Security (Video)

As cloud computing gains popularity, too few people are aware of the security threats that are emerging. In this short video, experts from HP discuss the latest cloud security threats and explain measures to help overcome them. Hear about the seven deadly sins of cloud security and learn how to avoid becoming a victim of poor security in your cloud environment.Intel and the Intel logo are trademarks of Intel Corporation in the U.S. and/or other countries.

Sponsor: HP & Intel

White Paper

Establishing a Strategy for Database Security is No Longer Optional

The options for securing increasingly valuable databases are very broad and deep, and can be confusing. This research provides an overview of three categories of controls that should be implemented to ensure that enterprise data is protected in the most efficient and effective manner.

White Paper

Database Activity Monitoring Is Evolving

Read the analyst report and learn how you can leverage the core capabilities of a DAP solution for better database security.

White Paper

Protecting Against Database Attacks and Insider Threats: Top 5 Scenarios

Read this new eBook to learn the top five scenarios and essential best practices for preventing database attacks and insider threats.

Webcast On Demand

Distributed Database Security with Real-time Monitoring

View this demo and learn how IBM InfoSphere Guardium database activity monitoring can help protect your sensitive data in distributed DBMS environments with a holistic approach to data security and compliance.

Sponsor: IBM

See more White Papers | Webcasts

Ask a question

Ask a Question