139

My girlfriend (let's call her Jane) just got a set of SMS or MMS messages coming from a friend of her (let's call her Hellen). These messages contain:

  1. Two photos of Hellen
  2. A voice message
  3. A text that says "I need help" followed by a Google Maps link.

And according to the messaging application, they where sent to 5 people, including Jane.

With all this being extremely suspicious, I told Jane not to touch anything on that messages and asked Hellen a bunch of questions:

  1. The phone is a Samsung Galaxy J5
  2. Android version is 7.1.1
  3. Hellen did not take those pictures of herself, and the pictures do look accidental, like if the phone took the photos while she was just holding it doing another thing.
  4. Hellen doesn't remember any recent apps installed or unusual web activity (I don't fully trust her on this one but whatever).

With the case exposed, I ask you:

  1. I am right assuming this is only Hellen's problem and as long as Jane ignored and deleted her messages she is safe?
  2. How should we proceed about Hellen's phone? A simple factory reset would do it?
  3. How can we prevent this situation in the future?
  • 39
    What's the content of the voice message? – That Brazilian Guy Apr 23 '18 at 15:20
  • 1
    Did Helen remember sending any of those messages and photos, or is it implied that this happened without her being aware of it at the time? – henning -- reinstate Monica Apr 26 '18 at 14:38
  • 2
    @henning She did it by accident and didn't even remember she had that feature configured. – ravasaurio Apr 26 '18 at 15:02
  • 4
    "... and while you were figuring out the questions to ask Hellen, she got killed" would be the ending of another story. – user79601 Apr 26 '18 at 17:45
  • 4
    @Paul Imagine an scenario where you're being assaulted, raped... I don't know, think bad things. You're not going to tell the assaulter: "hold on, let me call the police first". But three fast touches to the power button? that's easier to do. Of course your friends need to know those kind of messages are legit and if they ever recieve one of them, they call the police. The only problem I see with this feature is that is not a well known one, so we confused it with spam. Luckily there was no emergency going on. – ravasaurio Apr 27 '18 at 10:01
107

This is an exact description of the panic feature built into phones as Peter Harmann already said.

Anecdotally I can tell you on my previous Samsung smartphone, I could trigger this exact feature by pressing the power button 3 times in a quick succession. My phone would then take a couple pictures record a short clip of audio and then text those along with my current gps location to a list of contacts I had set up previously. This could actually be incredibly useful as a panic feature to get help when you are in so much danger that you can't otherwise call/text for help.

I'll address your questions a little more specifically:

  1. I am right assuming this is only Hellen's problem and as long as Jane ignored and deleted her messages she is safe?

If this was an actual emergency for Hellen, you absolutely should not ignore her cries for help. If this was some sort of virus, then it could take advantage in one of two ways:

  1. It sent you a link you need to click on. (Obviously, not clicking it is the correct action and you'll be fine if you don't click it. Just delete the messages so you don't accidentally click it in the future.)
  2. It sent you a text that is able to exploit your messenger app in some way. Like the single-character messages that crashed iPhones. In that case, you are compromised just by opening the text. Proceed assuming you have been compromised.
  1. How should we proceed about Hellen's phone? A simple factory reset would do it?

If this was a virus text, it could have come in multiple ways.

  1. Hellen's phone is indeed compromised. A factory reset might do it. Or it might not. Malware can be very hard to get off a machine once it has its hooks deep inside.
  2. The attacker didn't compromise Hellen's phone, they just spoofed her number to call/text their victims.
  3. The attacker impersonated Hellen in order to steal her number. Hellen's phone is fine (except that it no longer works as a phone because her number is stolen).
  1. How can we prevent this situation in the future?

Hellen can turn off her panic feature or take you off the texting list.

As for malware texts, there's not much you can do about your friends getting hacked except educating them or getting different friends.

What should you do if you get a text like this?

First, try to call your friend. They might actually be in trouble. Or they might be fine and it was just a mistake. Or it might be malware. Now you both know and can deal with it accordingly.

Second, they might not be able to answer you because of their emergency. Still don't click any links, but do call the authorities or other people who could help. Especially if the pictures or audio indicates they are in serious danger.

Third, if it is an emergency, you might need that information from the link (i.e. their location on google maps). You can type in the link manually if it looks like its a trustworthy destination (i.e. google maps). Or if this is time critical and you've confirmed this is an emergency, you might just have to bite the bullet and click the link.

  • 6
    Thank you for your answer Kallmanation. Don't worry about Hellen, she's fine. When I saw the message I told Jane not to click anything and tell Hellen if she wrote that messages, and she told us she didn't, that's why I thought it might be a virus. That and me not knowing that feature even existed. Jane and I have enabled it and instructed our closest friends and family members about how those SOS messages look like and if they ever recieve one on our name they should know how to act. – ravasaurio Apr 23 '18 at 15:52
  • 77
    "First, try to call your friend." Erm... you might not be doing a favor by doing this. Use your imagination a little. If your friend could speak on the phone she would've probably called just you... – Mehrdad Apr 24 '18 at 1:00
  • 20
    I'm with @Mehrdad. I can imagine scenarios in which someone might be coerced into assuring a caller that everything is fine. (Pretty sure I've seen this on movies/TV, and it looks plausible. At the least, I can't be the only person to have thought of this, so an attacker might be that one other person who has had the same idea.) – Mathieu K. Apr 24 '18 at 2:23
  • 49
    As @Mehrdad has not mentioned it explicitly - by calling your friend you can reveal his/her location in a case he/she is trying to hide. – abukaj Apr 24 '18 at 9:39
  • 23
    Seriously, does nobody watch horror flicks? Receiving an incoming call is about the worst thing that can happen when you're in a dangerous situation and trying to hide. – R.. Apr 25 '18 at 15:56
185

This does not seem to be a virus. It is a panic function in some android phones, that allows to send these messages in case you are kidnapped or otherwise in danger by pressing the power button 3 times. She must have activated it accidentally.

More info here and here.

  • 25
    @forest gadgetsloud.com/sos-feature-panic-button-smartphones and gs6.gadgethacks.com/how-to/… Please note that I did not read these articles in full, I know about this feature because I found it on my phone and set it up. – Peter Harmann Apr 23 '18 at 13:39
  • 8
    Although the question is about Android, iOS has a similar feature. – S.L. Barth - Reinstate Monica Apr 23 '18 at 13:54
  • 18
    Wow, I didn't knew about that function and I thought it was virus related. I asked her to check if it was active and it was, so that was "the problem" (I guess we can not call it a problem anymore) Thank you very much! – ravasaurio Apr 23 '18 at 14:33
  • 46
    Looking at the articles and from prior knowledge, this feature certainly does not apply to "all Android phones". It appears to be a manufacturer-specific feature, apparently Samsung. – multithr3at3d Apr 23 '18 at 15:35
  • 4
    @multithr3at3d It's actually a feature required for all phones sold in India. Manufacturers carried it over worldwide because they did all the work anyway. – user71659 Apr 25 '18 at 2:40

protected by Community Apr 27 '18 at 4:30

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.