Mobile phone users hit by SMS spam for messaging app

For most of yesterday, warehouse manager Eugene Lim's phone was buzzing every few minutes with a new SMS. -- ST FILE PHOTO: TERENCE TAN
For most of yesterday, warehouse manager Eugene Lim's phone was buzzing every few minutes with a new SMS. -- ST FILE PHOTO: TERENCE TAN

Many here flooded with texts asking them to sign up for app; telcos, experts advise caution

For most of yesterday, warehouse manager Eugene Lim's phone was buzzing every few minutes with a new SMS.

Each of the over 300 messages carried a similar invite - a "friend" wants to add him on a free instant messaging app called MessageMe.

Mr Lim was not alone. Many mobile phone users here have been hit with a flood of similar messages over the past couple of days, asking them to sign up for the app on the pretext that a friend had done so.

The messages, which appear to be sent directly from MessageMe, also come with a link that sends users to the app's iTunes store or Google Play page.

"It started about eight in the morning," said Mr Lim, adding that he has not clicked on the link. He also did not know any of those who have "added" him through the app. "The messages keep coming and it's draining my phone's battery very quickly," the 53-year-old said.

Telcos here said they have not noticed any unusual spikes in SMS traffic recently. But they, as well as security firms, are urging users to exercise caution before downloading any unsolicited content onto their mobile devices and to immediately uninstall any rogue app.

Security experts The Straits Times spoke to also said it was too early to tell what exactly is going on. At first glance, it may seem like a trojan - a type of malicious software which can steal information, including SMS messages.

But it could also be that the US-based app was designed to spam potential users, said Mr Joseph Gan, chief technology officer of local mobile security firm V-Key.

He explained that the app appears to seek permission to access a user's address book. "This is typical of social media or instant messaging apps like Facebook and WhatsApp," he said. "And many users will agree to it. But it seems this app has chosen to abuse those permissions."

When granted permission, the app appears to sweep through the address book of its users, sending mobile phone numbers in it to MessageMe's servers, he said. "The contacts are then added to its spam queue to send invites out," he added.

But there are still some quirks that have yet to be explained, said mobile developer B-Secure Technologies chief executive Paddy Tan.

For one thing, the messages seem to come from strangers, and not from people who know each other, as with the case of regular spam. Also, based on online chatter, it seems that the problem is affecting only Singapore. "If it was a virus, it should have been more widespread," he said.

Security firm Trend Micro said it is still investigating further to determine if "this is really suspicious activity".

For now, Mr Lim has installed an app to block all text messages coming from MessageMe. "Otherwise, every minute my phone keeps ringing."

derrickh@sph.com.sg

Additional reporting by Irene Tham