since some time, while browsing(SFW sites, news, blogs etc.), my phone browser - chrome redirects me sometimes to some strange pages asking me to go further if i am an adult, which I've never did. It was rather annoying, but since it did not happened all the time, I've ignored it. Lately I found out that If I accidentally click a button on this site it sends some costly Sms. Fortunatelly I blocked this kind of possibility with my operator, but I am a little bit amazed how it is possible. Does Android Lollipop (not rooted) allows to send SMS from browser without asking for confirmation? BTW there is no any trace of it on my phone. Only the answer from operator, that he can not complete my request, because I blocked it.
2 Answers
It sounds like they tried to force you to send SMS messages through a rogue telecom operator, which is essentially stealing money through text messages.
This exploit, it's not out of the question, necessarily. There was an article not too far back about how you can 'jailbreak' an iPhone by clicking on a link. The vulnerabilities are different, though, and I'm not really sure how they manage to find a hole to send a text message with.
Ideally, you should try to update to Android Marshmallow or Nougat (when it launches in earnest), or an equivalent version of Cyanogenmod, so you can get permission-by-permission control on your applications.
I can't say this is explicitly an answer to whether it's possible or not. At best, you've found an exploit that's already been patched. At worst, you've found an unpatched exploit that's being taken advantage of.
-
Thanks. I think that aside from the real reason of my problem it may be the time to move to cyanogenmod. Commented Sep 3, 2016 at 5:59
I've found out what is really going on. Some operators allow registering to some "premium services" via WAP. They use your network authorization to authorize the request. In this kind of situation you have to just click on link(which of course is hidden) and voila - you are registered to some high cost service. Unless you block this kind of premium services, what was fortunatelly my case. Anyway the information from the operator system is kind of misleading, therefore you may think(and also operator's call-center) that it could have been some sms send from your phone. So there was no sms sent without my knowledge via browser.