“Our analysis suggests that spammers are using infected computers and a fake mobile signature to try to bypass anti-spam mechanisms in the email platform they’re using,” a Google spokesman said via email in response to security researchers from Microsoft and antivirus firm Sophos who first identified what they believed to be the handiwork of an Android botnet.
Terry Zink, program manager for Microsoft Forefront Online Security, was the first to report about the spam messages in a blog post on Tuesday, noting that all of the emails come from Yahoo’s servers and they are sent from Android devices. “We’ve all heard the rumors, but this is the first time I have seen it — a spammer has control of a botnet that lives on Android devices,” Zink said. “These devices login to the user’s Yahoo Mail account and send spam.”
In a new blog post Thursday, Zink said that it is entirely possible that the Android Message-IDs from the spam email headers and the “Sent from Yahoo! Mail on Android” taglines were added by Windows malware as part of an elaborate deception to make it appear that the spam was coming from Android devices. However, it’s similarly possible that these messages appear in this way because they do in fact come from Android devices, he said.
“Before writing my previous post, I considered both options but selected the latter,” he wrote.
Security researchers from Sophos have also analyzed the spam messages, which advertise generic meds, penny stocks and e-cards, and have arrived at the same conclusion. “The messages appear to originate from compromised Google Android smartphones or tablets,” Sophos senior security advisor Chester Wisniewski said in a blog post on Thursday.