Premium SMS Toll Fraud
A malicious app could use standard Android APIs to send SMS messages. SMS messages could potentially be sent to premium numbers that charge the device owner and generate revenue for an adversary.
On iOS, apps cannot send SMS messages.
On Android, apps must hold the SEND_SMS permission to send SMS messages. Additionally, Android version 4.2 and above has mitigations against this threat by requiring user consent before allowing SMS messages to be sent to premium numbers .
|Use Recent OS Version||Starting with Android 4.2 the user must provide consent before applications can send SMS messages to premium numbers.|
Starting with Android 4.2 the user is prompted and must provide consent before applications can send SMS messages to premium numbers.
On Android 6.0 and up, the user can view which applications have permission to send SMS messages through the device settings screen, and the user can choose to revoke the permissions.
- Ryan Sammy. (2013, August 2). 10 Organizations Build 60% of Russian Toll Fraud Malware. Retrieved December 22, 2016.
- Google. (2014). Android Security 2014 Year in Review. Retrieved December 12, 2016.
- Graham Cluley. (2016, February 16). Android users warned of malware attack spreading via SMS. Retrieved December 23, 2016.