In November of last year, the mobile world was rattled when news of the CarrierIQ app secretly logging keystrokes and other mobile activities broke out.  People became paranoid and wanted to get rid of the app so they can have some peace of mind.  Many started searching for a solution – a quick fix– but some ended up regretting their actions.

Symantec and F-Secure released information that they have identified two Android malware apps posing as a CarrierIQ solution.  They offer to remove the CarrierIQ app from your device, as well as unlock hidden features, but the Trojans actually send text messages to premium rate phone numbers.

“From our analysis, Android.Qicsomos is a modified version of an open source project meant to detect Carrier IQ on a device, with additional code to dial a premium SMS number,” Symantec stated.

How They Work

The first Trojan, Qicsomos, currently affects French Android customers.  It hides in an app called “Detecteur de Carrier IQ” and appears on devices with an icon similar to Orange, a major European telecom operator. When the user notices the icon and presses “Désinstaller” (to uninstall Carrier IQ ), the Trojan goes to work: it sends four premium rate text messages, which the smartphone owner is then billed for, then erases itself.

The second Trojan, a malicious Russian Android market, pretends to scan the device for possible errors and new features that the vendor has hidden.  Then once the scan is complete, a download link appears, which when clicked, will send text messages to a premium rate phone number.

Trouble In The Market

Symantec stated that “Detecteur de Carrier IQ 2.0.4,” is not found in the official Google Android Market, which led them to believe that the malware is spread via social engineering or phishing campaigns pretending to be from an official mobile carrier.  That’s good news for consumers–it seems you’re still safe if you stick with apps from the verified Google Android Market.