Hackers have exploited the Google Cloud Messaging service, allowing them to upload malicious content which could in turn allow them to steal data from Android devices and send premium rate text messages without the user’s knowledge.
Google Cloud Messaging may not be a familiar name to most, but it’s Google’s way of allowing developers and businesses to send quick messages, app updates and more from a server directly to an Android device. If hackers are able to upload malicious content and applications to this service, they can then be triggered on smartphones and tablets.
Russian security firm Kaspersky Labs found the backdoor exploit and claims it notified Google of it on Tuesday. There’s been no official response from Google just yet, though we’re hoping they’re already looking into it.
This development means that hackers could potentially put Malware and Trojan exploits onto the Google Cloud Messaging system, which could then result in a malicious app being installed remotely on a device, unbeknown to the user. These apps could, for example, send hundreds of text messages to a premium number or steal contact information. It’s also thought that the exploit can block the infected device from reporting back to the server, so the company in charge of the device would never know.
Malware is becoming increasingly common on mobile devices, with Android being the most affected. Kaspersky has already detected one common exploit – Trojan-SMS.AndroidOS.OpFake.a – in 97 countries, with 1 million different fake apps containing it. These tend to sneak their way on to Android devices by masquerading as an update for a popular app, such as the Opera web browser.
The way to avoid this happening to your Android phone? When downloading an app, make sure it’s from the Play Store and check the reviews and ratings first – people will tell you if it’s a fake. To add another level of security you could also install something like BitDefender’s Mobile Security & Antivirus to scan your app downloads for Malware.
Be vigilant!