0

Some illegal ads started showing up on my Android phone as message boxes recently. They are said to be "USSD messages" in an app recording notifications (com.evanhe.nhfree).

There is a Wikipedia article about USSD, but mostly about the protocol. It's difficult to find any information about how they are actually used in modern smartphones, and the security implications.

So my question is, who are doing this? Are they (possibly or likely) from a service provider, someone contracted with them, some random person on the internet, or maybe malwares trying to hide the real source? Are they something like the email spams that I should just ignore them, or do they involve something more serious, such as hacking into the service providers, or using fake base stations?

The latest message specifically mentions "don't take screenshots", so I suspect they are afraid of the police finding something.

And as they are related to GSM, do they require downgrading to 2G to work?

Improve this question
6
  • I feel this question might seem stupid in places where USSD is widely used. But it's never used for legitimate purposes in my country at least in recent years.
    – user23013
    Oct 10, 2018 at 14:57
  • What country is this ? (might be useful info for potential answers) AFAIK, only your service provider can send USSD messages, so my guess is that it's either: malware attempting to hide (do you still get the messages if you put the SIM card in another phone ?), or it's actually your service provider or one of their contractors. Service providers like this often have surprisingly non-existant security - maybe their server that processes these messages got hacked and is sending these out. (In Europe USSD codes are usually used to show prepay balance: dial a short number, and balance pops up)
    – Jonas Czech
    Oct 10, 2018 at 16:06
  • @JonasCz China. Fake base stations was on the news not long ago. They have only sent 2 times, separated by about a month, making any tests difficult.
    – user23013
    Oct 10, 2018 at 21:22
  • @JonasCz Are they still in use in Europe, for 4G phones? Or are they specific to GSM?
    – user23013
    Oct 10, 2018 at 21:28
  • 1
    @JonasCz More like a scam. The "pay us and we'll tell you a stock, and we'll all buy this stock to raise its price" thing.
    – user23013
    Oct 11, 2018 at 17:23

2 Answers 2

Reset to default
0

I work in a telco and can tell you that we do use USSD messages. As far as I know, users can't generate them on their own, it has to be the provider. So it's either your provider that's compromised, or your phone. I'd send an e-mail to your provider (look it up on their website, it's probably '[email protected]' or something like that).

Improve this answer
0

It may just be the application to violate Google Play advertising rules and be serving ads on top of system notifications.

The app you linked is published as "contains advertising". Now you said that these notifications come from com.evanhe.nhfree. Suspect.

The question doesn't clarify whether the ads came out before installing the suspicious app or only after. If you try to uninstall the app, what could possibly happen?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .