Slashdot Mirror
30+ Infected Apps Pulled From Android Market
Trailrunner7 writes "Researchers have identified a second large batch of apps in the Android Market that have been infected with the DroidDream malware, estimating that upwards of 30,000 users have downloaded at least one of the more than 30 infected apps. Google has removed the apps from the market. There are at least 34 applications that researchers have found in the Android Market in the last few days that had a version of the DroidDream malware dropped into them. Once a user installs one of the infected applications, the malicious component, which researchers have dubbed DroidDream Light, will kick in once the user receives an incoming call. The malware then gathers some identifying information from the phone, including its IMEI number, IMSI number, packages installed and other data, and then sends it off to a pre-configured remote server."
Again, no list in TFA.
You have to dig through it to another article that links to a source article with a list:
http://blog.mylookout.com/2011/03/security-alert-malware-found-in-official-android-market-droiddream/
And that list is over two months old.
Which means this story's hardly viral. More like fungal.
The Lookout Blog has a list of the affected apps.
http://blog.mylookout.com/2011/05/security-alert-droiddreamlight-new-malware-from-the-developers-of-droiddream/
Can't wait for the day when such actions aren't news.
Here's the list: http://blog.mylookout.com/2011/03/security-alert-malware-found-in-official-android-market-droiddream/
Take a step back for a moment and think if this is really an earth shattering event. Some apps get pulled, big deal. Think of the bigger picture: maybe some people will quit playing games on their phones, get off the couch and get some exercise!
To the earlier link to cellphones causing cancer and now this, I say "GOOD!", let them go!
The vast majority of human evolution happened before the invention of radio waves and radiation flooding our bodies with their deadly effect. It has been only in the past 100ish years that people started to get ill with cancers, heart disease, diabetes and other ills caused by the rapid increase of vertebral subluxations.
Get off the couch, start exercising. Maybe consider a vegan, or at least organic vegetarian diet. Feel like a burger? No! All the hormones in beef to straight to your spine causing subluxation growth. Try a delicious organic veggie burger instead. Feel like potato chips? Try some yummy organic celery sticks with a misting of organic sesame oil!
Go for a walk, it's summertime, folks! Enjoy some no or light impact sports. Above all else, if you feel *anything* in your spinal area which just isn't right, get to trained chiropractor. They will attend to the subluxation and get you back on your path to good health!
You have only one life: MAXIMIZE IT!
Take care,
Bob
Chiropractic Saves Lives!
They should open source it, it won't get any malware then.
Oh wait..
http://blog.mylookout.com/2011/03/security-alert-malware-found-in-official-android-market-droiddream/
http://blog.mylookout.com/2011/05/security-alert-droiddreamlight-new-malware-from-the-developers-of-droiddream/
Hang on. Almost... GOT IT!
I wonder how many infected apps are in Apple's app store that /aren't/ getting removed? That's the beauty of the Android market!
The issue deserves concern, but 30,000 Android users seems like a very small number to me.
I went to eat some animal crackers and the box said, "Do not eat if seal is broken." I opened the box and sure enough..
I know its off topic slightly but i got a call from a number ....or even text messages with a link to call this number...
on my iphone, i imagine they are making some malware for iphones too, or is that just wishful thinking on the part of parties involved calling me
to get me to click on a link...anyone know or have useful links on the iphone for this too???
greatly appreciated
Android is /free/, man!
The apps were not "Infected" by the droid dream malware -- This would mean that malware was wandering around, infiltrating developer machines and the Marketplace itself... No. Instead, said malware payload was purposefully introduced to innocuous looking apps -- similar to the gift of a poison apple, or a Statuesque Wooden Horse Gift.
Hint: Legit app with "malware dropped into them." describes a malware infection about as well as Stigmata describes the actions of a depressed wrist slitter.
Apparently, the sex-censors have illegalized the word: Trojans. Either that, or the submitter is a moron.
Hmmm......walled garden, eh....(scratches chin thoughfully).....
Sorry, but using logic to defend your favorite platform has no use here. Please move along.
Sincerely
An Apple Product User
The real Sig captains the Northwestern. This one captains
The malware only activates when you receive one of these "phone call" things - and when was the last time you received one of those?
Whatever it is, it's notablog.
Despise other comments to this post claiming that these apps had the malicious payload intentionally included, I can't find anything confirming that's the case. Are we sure it's not a matter for developer keys (or even the Google Marketplace or phone OS) getting compromised? Anyone see that info anywhere
What I don't get is why no-one writes the package names of the malicious apps.
Application names are generally useless on Android since they can be duplicated freely (and there are legit apps with those names).
On the other hand, package names are unique in the Market.
Anyway, the list of the apps with the package names from the **previous** outbreak can be found here: http://globalthreatcenter.com/?p=2091
Also, a question: does the kill switch affect devices which don't have the market installed?
and then sends it off to a pre-configured remote server
So is the physical location of this server know? Because if it is, then whopass and wedgies may be delivered directly.
The three laws of thermodynamics:(1) You can't win. (2) You can't break even. (3) You can't even quit.
The apps were not "Infected" by the droid dream malware -- This would mean that malware was wandering around, infiltrating developer machines and the Marketplace itself... No. Instead, said malware payload was purposefully introduced to innocuous looking apps...
Sorry, but using logic to defend your favorite platform has no use here. Please move along.
Actually, I think it's just as bad (if not worse) that these apps can go into the official android market with such little oversight that they contain blatant malware. I wonder how much other malware and spyware is out there in the market apps.
Most Android users have encountered apps in the market that provide some stupid little function, but want a wide array of unrelated permissions on the phone. Who is watching these things to see what they really do? And how many average users are really thinking critically about what the app is asking for? Security-wise, I am getting some serious Windows 95/98/NT deja vu from the the Android platform.
Without having to resort to reviewing third party code like Apple does, I see one possible way in which Google could solve this problem without dedicating too many people to it. My solution is this:
By default, a developer account on the Market is "unverified" - when people try to install apps from an unverified account, they receive a huge, scary warning that states that this application could contain malware, please make sure you trust the author, etc.
To become "verified", a developer must contact Google personally and verify their identity, including full contact details (phone number, address, etc.), and sign a form that states something to the effect of "You are liable for all malicious code published through this account, even if your account is hacked." Punishment for publishing malware could include a financial penalty, and possibly criminal charges depending on what your malware did and what jurisdiction you live in.
And yet any time there is any sort of major problem with android or the android market the issue is swept under the rug by a lot of android users on /. and the focus goes back to bashing people who use apple products or concentrating on problems with definitions or semantics in the article instead of the issue at hand. Yes, us Apple product users are the ones being illogical...
Why waste your time with the market, go after the owner of the server.
Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
Just install that, and anything that attempts to go to the net, request IMEI numbers or anything else, it pops up and asks permission. It's funny/scary to watch how many programs that have absolutely nothing to do with anything, request to send contact info, gps info, tower info and IMEI info.
Typical dumbs ass Apple User reply.
"The apps were not "Infected" by the droid dream malware -- This would mean that malware was wandering around, infiltrating developer machines and the Marketplace itself... No. Instead, said malware payload was purposefully introduced to innocuous looking apps..." is a totally correct statement for any platform.