7

I'm using a non-rooted, non-hacked Samsung GT-I5700 device which runs Android 2.1.

Today I've received an MMS from an unknown phone with something which looked like a spam for Mastercard. I've immediately deleted this message, but it seems my phone has automatically sent this same MMS to one of my contacts.

According to the Messages app there was no other outgoing SMS/MMS to anyone else.

I've installed AVG from the Market and it said that my phone is clean. Still I would like to understand how this incident could happen since I haven't installed anything even remotely suspicious to my phone and didn't even browse the internet except for using Google Translate and Google Maps from time to time.

I'd like to know if it is possible for an app to delete or modify the history of sent messages. Can it clean up its tracks? Can it be possible that my phone has sent more than one SMS to my contacts only they aren't visible somehow?

I'd also like to know if it is possible to somehow deny outgoing phone calls and messages to apps so this could never happen again.

  • 6
    Is it possible that your contact just received the same MMS from the spammer with your number spoofed as the sender? – ale Nov 23 '11 at 15:57
  • @Al Everett: I don't think so since according to my phone there is an empty MMS with an attachment sent to this friend of mine. – Wabbitseason Nov 23 '11 at 16:06
  • Worth reading: Wikipedia: "Mobile virus" Seems there's been only one discovered Android SMS "virus" (actually a small trojan app), but even that requires user to accept installing a fake "media player" application. – Ilari Kajaste Nov 24 '11 at 19:58
6

I doubt that something like an SMS/MMS Virus exists or is "in the wild".

If this MMS was really originating from your phone, than this could only be caused by an malicious App. Now, there are two ways how any App can send/receive SMS/MMS:

By having the appropriate permissions

You can easily find out which App has requested, and since you installed it, granted, which permissions that App got granted. See this question for tools.

By exploiting the Android System

If there is an root exploit within the Android System and within the Dalvik VM, any App could use it to do anything. AFAIK as of Android 2.3.5 there are no public known exploits. Not sure what's the state in case of Android 2.1

SMS history

Editing the SMS history is not necessary. The history is part of the (stock) SMS client. If an Android App uses to API to send an SMS/MMS the history is not involved.

  • All I know is (1) I've received an SMS from an unknown number and (2) an SMS with the same contents was also sent from my phone to one of my contacts. Actually I'm mainly interested in learning whether it is possible for an app to edit the SMS history. – Wabbitseason Nov 23 '11 at 17:21
  • @Wabbitseason I have updated my answer – Flow Nov 23 '11 at 19:18
  • 1
    So in other words it would be entirely possible for an app to send out countless SMSes without my knowledge and I wouldn't know about it until my huge bill arrives from my phone service provider? – Wabbitseason Nov 23 '11 at 20:22
  • 2
    @Wabbitseason If you gave an (malicous) App that permission or there is an security issue witin Android, yes. But Android, especially 2.3, is realtivly secure and mature. You should always check which permission(s) an App requests before installing it. App that request the "send SMS" permission are possible "dangerous". That's why I didn't update facebook since they request this permission. – Flow Nov 23 '11 at 20:41
  • Thank you, I have accepted your answer. Unfortunately my current phone can't be upgraded so I guess that's the end of the story for now. – Wabbitseason Nov 23 '11 at 21:53
1

Actually there is an MMS bug known as "stagefright" that basically gets sent to you from somebody on your contact list and auto-extracts spyware on your android. This happened to me and the person who sent me the MMS was actually my "friend". I would recommend doing a factory reset and turning off the auto-retrieval option of your mms to off (as it is turned on by default). Then change all of the passwords for the accounts you have used on your phone, particularly your google account as any spyware may have been pushed onto any of the google services (drive, offline docs, etc.) and make sure no compromised files are reloaded onto your factory reset phone.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.