Don DeBolt, director of threat research, CA Technologies, ISBU
July 01, 2011
What is it?
Mobile malware which leverages trojan, bot and “logic bomb” tricks.
How does it work?
Infection requires the installation of a trojaned app called “Holy ****ing Bible.” Following installation and a reboot, a rogue service is started that queries a remote location for command-and-control instructions while attempting to communicate the device's phone number to another host-based service. An SMS listener, is controlled via the logic bomb and only starts when the system time reaches May 21, 2011. A doomsday message is then spammed via SMS to all contacts. On May 22, a new message is sent out, and the wallpaper gets changed.
Should I be worried?
It illustrates that tricks employed against the PC platform will be repackaged against the Android.
How can I prevent it?
Installing only Android Market apps is a start, but we recognize the openness of the Android platform is tempting, so a mobile security app is recommended.