Analysis on the operating mechanism and principle of fee deduction Software

When you play games or go to Weibo, you will be able to uncertain deduct your phone bill. After careful inspection, I found that I have not installed any black-hearted software, which is a common application of "Weibo", "365 calendar", and "anti-shita Tower". How can I reduce my phone bills ?! I have seen such a post several times, and I always thought that I would not use the white packet that is not switched by the APN to be stolen from the traffic. It was not taken seriously. It was not until today that I suddenly got more than 50 yuan of value-added service fee in my phone bill that I was alert. Rom is my own, and there is certainly no problem. After checking the software in my hand one by one, I will lock the target on the "anti-skeleton Tower. When I uninstalled and reinstalled the game, I found that the anti-tower games prompted me to use the text message permission, which is the only problem!

Analysis of the APK package found that the fee deduction code will be embedded into the initial entry for program startup, and will run every time after the program starts. Our mobile phone number, imsi, iccid, IMEI, and other information will be collected during the operation. Of course, this is all done without knowing it. The information is then sent to the VPC, and the server address is encrypted and obfuscated. They are also afraid of being captured.


After receiving the information, the Black server will return a command to inform the deduction program to send a text message to the specified phone number, and secretly install the specified software, or even specify whether to use a browser to open a special website, it can be used to determine the existing browsers.


After a text message is sent, the deduction number will generally return the deduction information. At this time, the deduction code will intercept the receipt text message, and you will not receive any prompt, so you will pay the money through the text message.


In addition, I found that some software will be paid for promotion, such as some browser software and Input Method software. The general solution is to find a partner and provide the partner with an installation package marked by the partner. For example, if a browser software is promoted through website a, a software package of Version A is provided to the other party, so that Network A can use its own Rom or other methods, let version A appear on your mobile phone. When you run version A, you add a user to the browser, the corresponding a website will receive two to three promotion fees. You can pay attention to which rom has built-in domestic software, and you can basically know how much a ROM or other methods will bring to.


This deduction code is powerful because it collects a lot of software tags for these paid promotion companies. When you run the software that embeds the deduction code, not only did you lose the telephone fee, these companies will also receive statistics about the number of users they have added and think that you have become their users. Therefore, they will pay the fees to the Code makers. Bad enough!


Now, you should have a basic understanding of the mechanism of fee deduction code. This time I will talk to my brothers here. The moderator found a new sample of the deduction software. I will continue the analysis and strive to finish the analysis tool at night!


For beginners and how to avoid fee deduction code software, please refer to the "malicious fee deduction software popularity Stickers" published by the kitaroshi moderator. Please be vigilant! Prevent problems before they happen.


If you do not know whether you are recruiting, first check the list of blacklists of malicious implant deduction software updated by the "n multi-network daily update of the software blacklists" updated by the kitaroshi moderator every day. Please be vigilant! [Update to 20101229]. If you find the software you have installed in the blacklist list, call the phone number to check whether the phone bill is abnormal.


Of course, even if the software you have installed is not in the blacklist list, you should check your phone bill and pay special attention to the value-added service fee.