Texting Trojans

This week we received a sample of a variant of W32/Backdoor-DJC.

W32/Backdoor-DJC is a standard href=”http://wwwmail-archivecom/cert-advisorycertorg/msg00061.html” title=”What are targeted trojans?”>targeted backdoor trojan. It steals information from your computer and sends it back the attacker. Instead of using email to send back the stolen data, this variant uses SMS.

Using SMS to transfer stolen information. Malware authors are branching out in their communication methods. Not really innovation. System administrators have been able to monitor their machines via SMS for quite a while. This is more an example of malware authors turning legitimate methods and tools to their purposes.

Previously we've seen similar information stealing trojans on mobile phones. SymbOS/Pbsender swipes your phone and contact info and sends it out via Bluetooth.

Bluetooth is not as effective as email or SMS for sending information. Consider some of the difficulties involved:

• receiving anything requires user interaction, you can't let it sit in your inbox
• you need to be within range, if you're not there you don't get the message

On the other hand with SMS:

• your messages end up in the inbox
• range is not an issue, you can even be in a different country
• your phone does not even have to be on

Once a tool or communication method has been proven effective legitimately it is common for us to see them integrated into malware. So it's no surprise that SMS has now reached this stage.