Google Remotely Nukes Apps From Android Phones

itwbennett writes "Google disclosed in a blog post on Thursday that it remotely removed two applications from Android phones that ran contrary to the terms of the Android Market. From the post: 'Recently, we became aware of two free applications built by a security researcher for research purposes. These applications intentionally misrepresented their purpose in order to encourage user downloads, but they were not designed to be used maliciously, and did not have permission to access private data — or system resources beyond permission.INTERNET. As the applications were practically useless, most users uninstalled the applications shortly after downloading them. After the researcher voluntarily removed these applications from Android Market, we decided, per the Android Market Terms of Service, to exercise our remote application removal feature on the remaining installed copies to complete the cleanup.' The blog post comes a day after security vendor SMobile Systems published a report saying that 20% of Android apps provide access to sensitive information." Update: 06/25 16:44 GMT by S : Clarified last sentence, which incorrectly suggested that 20% of Android apps were malicious. According to the report (PDF, which we discussed recently), "a majority of these applications were developed with the best of intentions and the user data will likely not be compromised.

Comments

oh noes!

[Random2]

They removed an app that violated the terms of service.

Seriously, stop with the fear mongering. Although I trust google as far as I can throw their data centers, citing false reports and spreading misinformation is just stupid.

Also, as pointed out in the previous article, those 'exposing' apps can only take what information you expressly give them. Thus it is not news.

Re:oh noes!

[Anonymous Coward]

No, they deleted it FROM MY TELEPHONE. Not stopped selling it in their store, not rejected it in the review process, not sent me an email telling me that there was something wrong with the app and maybe I might want to delete it. THEY DELETED IT FROM MY TELEPHONE.

Without asking me.

I thought I could run any app I wanted? That is what you people told me.

And 20% malicious apps? As if there weren't enough problems getting iphone 4s as it is....

Re:oh noes!

[Richard_at_work]

This is exactly the same as the Kindle 1984 issue, and it most certainly is news - Google removed an installed app from an end user phone without their permission, and that is a bad thing regardless of why they did it.

If the app violated the terms of service, then Google should have ceased to supply it (if the author hadn't removed it first), but they should most certainly not have altered an installed application.

Re:oh noes!

[mmurphy000]

Without asking me.

They asked you in the Terms of Service you agreed to when you used the Android Market for the first time.

I thought I could run any app I wanted? That is what you people told me.

You do not have to get your apps through the Android Market. Anything you install outside of the Market is your responsibility.

Re:oh noes!

[Oliver Wendell Jones]

This is exactly the same as the Kindle 1984 issue

Uh, No... it's not. The Kindle users with copies of 1984 *paid* for those copies - the apps that were removed were free apps. And, the apps did not do what they had claimed and had a hidden, although non-malicious purpose.

The only way this would be similar would be if the Kindle copies of 1984 had been free, weren't actually 1984 when you tried to read them, and reported back to the publisher any information that they thought was relevant.

Re:oh noes!

[rolfwind]

They asked you in the Terms of Service you agreed to when you used the Android Market for the first time.

AT&T asked for my 1st born and 10 years indentured servitude in their TOS. It was 900 pages so I didn't read it. Oh well, I guess that makes it right and okay then.

Re:oh noes!

[laffer1]

Google should have created a feature to notify/ask the user about removing the application on their phone. There's a big difference between warning someone and just deleting something.

To me it's irrelevant they were free applications. I don't care if a book or an app are free or I paid $10 for them.. don't delete stuff on my phone or ebook reader.

Re:oh noes!

[Richard_at_work]

Whether payment was made or not is actually irrelevant as it doesn't alter the ethical, moral or legal consideration in this - Google altered a device it does not own, and has no legal standing to touch.

Re:oh noes!

[Deliveranc3]

Agreed, now I need to be paranoid about degraded service. Such as my TruPhone app, which mysteriously crashes, or my alternative markets which seem to be having problems.

Further since I'm deploying these phoens I need to worry about Google breaking them in addition to users.

This is really a problem for them having corporate appeal.

Re:oh noes!

[rolfwind]

And yet you agreed to it. Fool.

> Oh well, I guess that makes it right and okay then.

Unconscionable terms are unenforceable. You're still a fool for agreeing to unread terms, though.

You can call me a fool yet how many end user licenses have you fully read through? All of your products and services? I know I would have no time to work or play if I had to read (and understand each one). And that's what we're talking about. I read through contracts that I have to go through the whole nine yards and sign....

But I buy a product, say this Soda Stream maker:
http://www.amazon.com/SodaStream-Soda-Seltzer-Maker-Starter/dp/B002SKHQS4/ref=sr_1_1?ie=UTF8&s=home-garden&qid=1277472294&sr=8-1

Only to find out after the fact that it has an end-user license dictating what cylinders you can put in (it has a propietary attachment) and all the like. I think we're all fools for putting up with it.

Re:oh noes!

[drinkypoo]

Uh, No... it's not. The Kindle users with copies of 1984 *paid* for those copies - the apps that were removed were free apps. And, the apps did not do what they had claimed and had a hidden, although non-malicious purpose.

I don't think you can call software which does things it does not say it will do "not malware". It's fraud conceived to get the user to run software they did not intend to run, which is malicious whether it seeks to do damage or not.

Re:oh noes!

[substance2003]

> AT&T asked for my 1st born and 10 years indentured servitude in their TOS.

How do you know that if you didn't read it?

He doesn't. It's called being sarcastic (a lost art it seems).

> It was 900 pages so I didn't read it.

And yet you agreed to it. Fool.

That put him in the same boat as 99.9% of the population. Care to make a bet that you've actually read the terms of license of all the neat stuff you own and use?

Let's be serious here. If people did actually read over these license terms, do you really think they would completely understand what they are accepting? I've seen an instance or two in law where one paragraph on say page 10 has an exception on page 31 and written in an obscure way.
Even people with a Bachelor in law would get confused. We wouldn't otherwise need to go to court when there is disagreement.

> Oh well, I guess that makes it right and okay then.

Unconscionable terms are unenforceable. You're still a fool for agreeing to unread terms, though.

You can only avoid it being enforced if you have at least have two of the following:
1. The proper knowledge of the law to defend yourself in court (or perhaps sue in this case).
2. The time for a lenghy battle.
3. The money for a lenghy battle.

Or make a big enough stink on the television to make said company look bad and reverse their decision.

Re:oh noes!

[Snaller]

"They asked you in the Terms of Service you agreed to when you used the Android Market for the first time."

Don't be an idiot. They KNOW - and YOU KNOW - that nobody reads that. That's to keep their backs clear in the case of a legal battle - it does not absolve them of being amoral and on the way to evil.

"You do not have to get your apps through the Android Market. Anything you install outside of the Market is your responsibility."

Right until we find some other small print which allows them to control that as well.

Re:oh noes!

[rolfwind]

I also have to say that "agreeing" part is a bit strong. When I buy something, I buy it, not agreeing to anything but to exchange my money in return for some product. I also don't sign anything. The end user license agreement isn't there at the point of sale and is often hidden in the box.

The end user license agreement isn't my idea of a "contract". It's more like a kick in the ass after you did the exchange.

Re:oh noes!

[Snaller]

"Stop being disingenuous, they did it with prior notice, and with your permission."

No. You know, and they KNOW that nobody reads that. Its to avoid lawsuits, it is not something people read - people have an expectation, and they didn't expect that google would turn big bad amoral creep and screw them like this.

"Furthermore, having done it, they informed you."

Who cares, that's after the fact. They should NOT have the ability, the "agreement" should be changed right now, and the next version of Android should have this censor ability removed.

Re:oh noes!

[realityimpaired]

Actually, I have read the EULA for all of the software that's installed on my computers. Some of them drone on for pages and pages of legalese, some of them (like the BSD or MIT licenses) are actually easily human-readable.

I don't re-read the LGPL or the GPL every time I'm presented with it. I don't need to. But I do read each version that comes out to make sure I understand my rights and obligations. Similarly, Microsoft has a standard EULA that gets used for 95% of their software... if you've read the Windows EULA, then you've read the Office EULA. Most of the time, the EULA is simple standard legalese for "it's not our fault if your computer breaks, you agree not to steal this software, you agree not to use it in a way other than its original design purpose, you agree not to sell the software to terrorists."

It doesn't take *that* long to read an EULA, and 5 minutes of reading can save you tons of headache down the road. I have refused to install/use software in the past because I disagreed with the terms of the software, and I have successfully returned said software for a refund (though usually by contacting the vendor rather than the point of sale for my refund). Caveat emptor. If you blithely agree to and click through any license you're presented with, then it's your own fault if you get burned for it.

In fact, you don't even have to *buy* software to find the EULA. Many publishers put their EULA up on the 'net for you to read before money ever exchanges hands. A quick google search for the title (or publisher) of the program in question and the word "eula" will reveal most of them, and I have yet to encounter a publisher who won't happily e-mail me a copy of the EULA for me to read prior to buying the software.

even the evil empire and their red-haired cousin.

Coincidentally, you the EULA that tipped off this whole debate can also be viewed online without ever purchasing an Android device.

Re:oh noes!

[idontgno]

Unconscionable terms are unenforceable. You're still a fool for agreeing to unread terms, though.

Here's unconscionable for you: you don't reach into my phone and delete stuff. Period.

Yeah, guess what: just because it's common doesn't make it right.

Re:oh noes!

[msauve]

"You know, and they KNOW that nobody reads that."

Well, to use your argument, you KNOW that nobody had any use for the app-which-did-nothing which Google removed. So, what's the fuss?

Re:oh noes!

[geekoid]

Argument from the extremes is a logical fallacy. As is comparing removing a malicious app to taking your children.

However, if it's to long to read, don't sign it.

Re:oh noes!

[Adrian Lopez]

Stop being disingenuous, they did it with prior notice, and with your permission.

It seems to me you're the one who's being disingenuous. While they do give notice of their "right to remotely remove" certain applications from people's devices, they gave no prior notice with respect to the particular application being removed and obtained no explicit permission for such removal. It's all hidden away in the terms of service, which most people never read and which people are presumed to have agreed to merely on the basis of their use of the service.

But what if I liked the application

[ZeroExistenZ]

This raises again the question wherever we need to call murder and fire about privacy and "it's my phone don't touch it" kindof thing.

OTOH, the marketplace is a "trusted content provider" in control and under the responsability of google. In that regard, I think they have the right and obligation to "keep the market clean", for me it would become unacceptable if they start to remove applications who are "breaching vague copyright claims", and take a weak stance or remove applications on nonsene like that.

If the application would've advertized or mentioned it was "for research purposes", I don't think google should've removed it.

But it's my phone, and if I want to run malicious software on it, I feel I should be able to do so. But I cannot expect the "marketplace" to hold malicious software because I want that possibility.

Re:But what if I liked the application

[ZeroExistenZ]

Fair enough.
If I want to kill those who enable the creation of botnets, I feel I should be able to do so.

I'm a developer, I love to experiment and thinking "outside of the API" and such. It's why I've been extatic with access to opensource smartphones (before Neo1973, think 5 years ago, I was hoping for an affordable wifi-enabled cellphone with decent API to implement VOIP dailing and implement my messaging and email off the GSM grid to cut costs and for coolfactor. Android has brought this to the world.).

So it's a bit the interpretation of google what is malicious or not (I'm not a hacker, I just poke around) and shouldn't control what I want to do with my device. But it's perfectly acceptable for them, according to my concepts, to enforce their interpretation of "malicious" onto people using the marketplace, as they trust google to make a good judgement and for this software to be clean.

I live in Belgium, lets have some fun ;)

Re:But what if I liked the application

[Yvanhoe]

Can someone please explain to me, who never owned an Android phone, how the hell this kind of thing is possible ? I can understand that App Store is like a debian repository where packages need to be approved to be available and that malicious packages that get erroneously accepted can be removed.

What I don't understand is how it can remotely removed. By default Android has a backdoor for Google ? Is that true of any version of Android ? Can we remove it from the code (since, unless I am mistaken, Android is OSS) ?

I'm fine with repositories and security updates, but nuking an applications without asking first is what Steve Jobs does and that Google is not supposed to do. I agree that in the present case, this was for a greater good, but this is not the point. If I buy an Android phone, do I own the damn phone and do I control it or not ?

Re:But what if I liked the application

[Culture20]

I'm fine with repositories and security updates, but nuking an applications without asking first is what Steve Jobs does and that Google is not supposed to do.

I hate iPhone OS policies as much as the next geek (why don't I get an upgrade for security on my original iPhone, even to iOS 3.1.4?), but even Jobs doesn't delete apps from your phone. Any apps once through the store, are yours, lock, stock, and barrel. They may prompt you to upgrade, they may stop selling an app, but they don't delete them.

What google should be doing is sending these users an email and free SMS letting them know that they "should delete app $FOO because it's potentially dangerous. For reference, please see https://google.com/android/press-release/93857293875928.html" Maybe some people wanted these apps... like the friends of the security researchers in question.

Draconian?

[ilovegeorgebush]

Why do they have to have or at least exercise this feature of the ToS?

Why couldn't they just get a list of those who have it installed (surely they know that?) and then email them? Beats this draconian/big brother approach in my opinion...

Re:Draconian?

[Anonymous Coward]

Apple has never removed an App from anyone's phone. They have removed it from the APP Store.... that is a big difference.

Re:Draconian?

[mmurphy000]

Mostly because they do not have email addresses of everyone. They have Google accounts, but not everybody who has a Google account for the purposes of Android uses GMail.

Still doesn't bode well

[Moraelin]

I dunno, wasn't the hype that Android is all open and based on Linux, and _totally_ unlike the iron grip that Steve Jobs has on the iPhone?

And weren't most of us ranting about how even DRM and "Trusted Computing" are bad because someone else gets to decide what you can or can't run on your computer? When did _that_ become good if it's Google doing it?

Re:Still doesn't bode well

[Sockatume]

If the application had been downloaded and installed outwith the Android Market, which is an option on Androi,d then Google could not have done this, so yes, you have that freedom.

Re:Still doesn't bode well

[Enry]

There's plenty of unofficial ROMs you can install that have the additional functionality. In that way, it's more open than most other phones on the market.

Re:Still doesn't bode well

[MORB]

Google has a lot of control on the android market, true. But unlike the iphone it is not the exclusive way to distribute apps.

You can install a .apk (android aplication package) from any source. Web, email, or tossing it on your sd card through usb.
Setting up a third party app store for android as tightly integrated as android market is also perfectly possible.

So essentially yes, you can do whatever you want. It also means that google have to keep playing fair with android market if they want to avoid people defecting to third party app stores.

Re:Still doesn't bode well

[AHuxley]

Anything but open is true, think of Android as Microsoft's reimagining of Linux with a $699 2 year plan.

Re:Still doesn't bode well

[LordAndrewSama]

I agree with "needs to be able to protect their customers and their business" and disagree with "did something to my goddamn phone without my express permission".

How about a compromise? A notification that says "WARNING - This App is malicious, we recommend you remove it. [Uninstall App] [Cancel]"

Protecting their users without having the ability to remotely alter my phone without my permission. win-win.

Re:Still doesn't bode well

[Enry]

An unofficial ROM != jailbreak.

Installing OpenWRT on a Linksys router likely voids the warranty in the same way that installing an unofficial ROM on an Android device does. Yea you might brick it, but those are the chances you take to get the extra functionality. Don't like it? Wait for an official release.

In the case of Apple, they're actively preventing jailbreakers from working. Seems a bit different to me.

Re:Big Apple vs Google distinction:

[Americano]

So "when it's in service of a good cause," violating user privacy and the ability to own your phone is okay? Or is any measure acceptable if it's claimed to be to eliminate a risk? Or is it Google good, Apple bad, still? I'm very confused.

Do not want

[Andy Smith]

I don't want this. Not on Android. I specifically bought an Android phone to get away from the Apple control freakery. That was the only reason I wanted Android -- no big brother overseeing. Now I find that Google can throw a remote kill switch?

Do NOT want.

Yes I can see the argument that the app killing on this occasion was a Good Thing. But no, really it's a Bad Thing, because it represents the top of a slippery slope.

Hands off my phone please people who are not me!

Re:Do not want

[Tim C]

I don't want malicious apps on my phone either, but I do want to be treated like an adult and told that an app I have is malicious ("...and so we strongly recommend you remove it immediately..."), not like a child and have it removed on my behalf.

I'm ok with this

[Genocaust]

For those of you complaining about this, please note that it was "per the ToS". Don't like it? Don't use the (Android) software, then. It's a free market -- vote with your money elsewhere. Until this remote nuke feature is used on something I've PAID for, and I'm left without my app or my money, I'm not too bothered by it as, again, I AGREED TO THE TOS.

Re:I'm ok with this

[Lunix Nutcase]

I think that point is that if Apple did this it wouldn't just be shrugged off. The Android fanbois would be coming out of the wordwork to howl about how Apple is messing with people's phones.

Re:I'm ok with this

[FreeUser]

I think that point is that if Apple did this it wouldn't just be shrugged off. The Android fanbois would be coming out of the wordwork to howl about how Apple is messing with people's phones.

As one who is leaning strongly toward Android and won't buy an Apple iPhone for a number of reasons, some technical, some philosophical, some practical, I have to agree with this.

Having anything removed or tampered with by any outside agency on hardware I have purchased is unacceptable, full stop. I don't care what ToS conditions are buried forty pages down in the Android App store's click-through screen, in two-point type.

Google should not get a free pass on this, any more than Apple would, and it's made me reconsider my intended purchase very carefully. Not that I'm about to become an iSlave to Jobs ... but I am equally unwilling to become a gSlave to Google. This kind of unilateral tampering with other people's property, ToS or not, simply should not be condoned or tolerated, whatever their motivation.

What is it with digital?

[AHuxley]

Sony removes Linux, Amazon removes books, MS removes music/Sidekick data issue, Apple watches over software, isp's shape traffic, telcos get a national security letter on domestic phone tapping ect . A search/ad company sucks up data around the world.
Then they expect the end users to take them seriously.
Time to think long and hard about any new 'rental' telco device.
Physical media and a fast desktop computer seem rather wise now.
Maybe try a http://en.wikipedia.org/wiki/MeeGo supporting device to keep your property backed up and safe from remote interference/incompetence/mistakes.

What they should have done

[Lord Bitman]

When the app is clicked on, it should open a page that says: "Note: Google has determined this app to be malicious / in violation of terms of use. Tap here for a complete explanation. The app has been removed from the store, and running it is not safe. Tap here to safely and permanently remove this app"

All they did...

[bigrockpeltr]

... was to remove a couple (relatively harmless) trojans for free. Maybe we should be thankful for the service.
I wonder if these apps really were for legit research then the researchers could/should have asked google to remotely uninstall them since you shouldn't leave your apparatus lying on the floor after an experiment.

Re:What the hell dude, enough with the sensational

[whisper_jeff]

As an Apple fanboy who's tired of seeing the anti-Apple sensationalism in other postings (ok, even the blatantly pro-Apple sensationalism is annoying too), allow me to say that the 1-in-5 comment in the summary was absolute FUD. It really would be nice if story submissions were more about the story and less about furthering marketing agendas for/against a given product. I realize we're all passionate about our particular sections of geekdom but this is just getting pathetic. I think it's interesting that Google exercised their orbital nuke option (for a variety of reasons that I'm sure will be discussed in other threads below) but the little addendum to the story was completely irrelevant and served only one purpose - to troll. Would be nice if slashdot editors removed those extra tidbits.

The Cowboys meet Big Brother

[rclandrum]

I gotta admit, I am laughing my ass off. After a year of listening to Slashdotters slam Apple for it's overly restrictive App store policies (Waaaa - I can't run any piece of crap app I want - waaaaa), it is like a breath of fresh air to see a *real* big brother operation in action. Google can remotely yank apps directly off that "completely open" phone? Priceless.

The days of user-managed consumer computing devices is just about over. The future is stringently managed devices and no unapproved applications. Why? The device manufacturers must ensure a seamless user experience - any hiccup in either hardware or application just helps sink a product in this highly competitive space. And OS manufacturers (not to mention the users) are fed up with security breaches and malware - better just to lock it all down, and eliminate the complaints and problems. The vast majority of users have no desire whatsoever to manage anything on their computers - they just want to buy and play the games or run apps that never crash. Keeping up with the latest viruses is something only totally uncool people do anymore.

The cowboy days are over, folks. The wild, wild west is becoming settled.

Only one way to own a computer anymore

[Junior J. Junior III]

Basically, what this is leading to, is that the only way to own a computer is to own not just the hardware and the software, but also the network and the services that run on it. If you don't, you're pwned by the owners who do own these things. It's not enough for hardware and software to be free; the network and services also need to be free and open. Anything other than total and complete freedom opens a backdoor through which all your freedom will eventually leak out, given enough time.

So, good luck with that. You'll never own everything. It's damn hard just to own the software, let alone the hardware that you purhcased. Forget about ever owning the network or the services; these are things that are inherently communal. Only, there's large corporate superorganisms out there who will dominate any individual or group of consumers.

And even if you could own it all, that only means that it's possible for, at most, one person to be free. Everyone else is either enslaved, at risk of enslavement, or a non-participant.

Might as well give up and let them implant slave chips in the back of our heads.

Where's the outrage?

[khchung]

Wow, Google pulled an Amazon here, remotely DELETED an app from users' phone... and half of the posts here are OK with it?!

Where's the outrage? Isn't the big ADVANTAGE of Android is that it is YOUR phone, which you CONTROL, and that YOU decide what to put on it? Now Google, not only told you they hold a REMOTE KILL switch, but actually went and DID a remote kill, and wow, half of the posters here are fine with it.

Amazing.