Slashdot Mirror

← Back to Stories (view on slashdot.org)

Android Malware May Have Infected 5 Million Users

Posted by timothy on from the there-aren't-enough-whips-in-the-world dept.

bonch writes "A massive Android malware campaign may be responsible for duping as many as 5 million users into downloading the Android.Counterclan infection from the Google Android Market. The trojan collects the user's personal information, modifies the home page, and displays unwanted advertisements. It is packaged in 13 different applications, some of which have been on the store for at least a month. Several of the malicious apps are still available on the Android Market as of 3 P.M. ET. Symantec has posted the full list of infected applications."

30 of 280 comments (clear)

  1. Those Counter-Strike "Clones" by gman003 · · Score: 4, Interesting

    I've always thought it was odd that those games that literally copied Counter-Strike were allowed on the Google Market.

    I know, you're about to say "copying gameplay, while unethical, is completely legal". Problem is, they didn't copy the gameplay - they're boring rail shooters. The copied stuff is the art - the textures, models, even some of the maps. And that's blatant copyright infringement. It's obvious even from the previews, if you've played the game enough. And since, at one point, people playing cs_italy were responsible for more bandwidth usage than actual people in Italy, I'm pretty sure I'm not the first to notice it.

    I figured Valve, being pretty savvy about this sort of thing, figured that suing them would give them too much publicity - Streisand Effect and all that, not worth the huge amount of publicity that anything Valve does. Now, I'm thinking that iApps7 was just ignoring the cease-and-desists, because when you're already distributing malware and committing actual, commercial copyright theft, you're probably not too afraid of lawyers.

    1. Re:Those Counter-Strike "Clones" by Anonymous Coward · · Score: 5, Funny

      I've always thought it was odd that those games that literally copied Counter-Strike were allowed on the Google Market.

      I know, you're about to say "copying gameplay, while unethical, is completely legal".

      Apparently, it's only red double decker buses on a black and white picture that can be not made similar.

  2. Google Needs To Get Their Ass In Gear by rsmith-mac · · Score: 4, Insightful

    Although I seriously doubt Symantec's 5 million number is right, the fact that malware keep showing up on the market is disturbing. Actually, we're beyond disturbing, it's getting downright annoying. Google needs to do better than removing bad applications after the fact, and while this doesn't need to be a Jobsian walled garden, at a minimum Google needs to start reviewing all applications (and updates!) before posting them to make sure they're clean.

    Phones are appliances, and trying to handle malware the same way we handle it on computers (which is to say, after the fact) is not going to work.

    1. Re:Google Needs To Get Their Ass In Gear by Nerdfest · · Score: 5, Insightful

      What they could do is provide the same sort of "reviewed application" market that Apple does, but as an option (as I believe Apple should). I see that as the best of both worlds. If you want to lower the odds of malware, use that market. If you don't mind a little risk use something else, like the current Android market.

    2. Re:Google Needs To Get Their Ass In Gear by hey! · · Score: 5, Interesting

      Consider the difference between the following questions:

      (1) Who can *you* trust?
      (2) Who can *everyone* trust?

      The problem with the Apple market, and with your idea too, is that it is predicated on having an answer to the second question other than "nobody".

      It seems clear to me that a better solution could be built around the first question. That entails letting the consumer decide who he trusts to review and approve apps, then giving him the tools to implement that trust. That'd involve some kind of network to distribute digitally signed approvals. You wouldn't have to have different app stores. You could use any store or combination of stores you wanted. What matters is whether you can find a certification for an app from an authority you trust.

      Consumers would subscribe to different authorities based on their concerns. Businesses might choose different kinds of reviewers to trust than gamers. Different functions in a business might choose different reviewers based on the kind of information they handle (e.g. whether the device running the app has sensitive or privacy related data). Evangelical Christians might choose review authorities that reject apps that promote pornography, and porn-hounds would choose authorities that reject apps promoting Christianity.

      --
      Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
    3. Re:Google Needs To Get Their Ass In Gear by Overly+Critical+Guy · · Score: 3, Insightful

      I have encountered all of a handful of users with tablets and each has said basically the same thing.

      With a sample size like that, how could you be wrong?

      For crying out loud, we're onto year three of the iPad, and it sold over 15 million last month. This is as much a "fad" as the mouse and GUI. If you don't see the inevitability of this, then frankly you are out of touch. Nobody wants to install and maintain a PC just to browse the web anymore. The same kind of streamlining already happened to gaming in the 2000s via consoles.

      --
      "Sufferin' succotash."
    4. Re:Google Needs To Get Their Ass In Gear by stephanruby · · Score: 3, Interesting

      Although I seriously doubt Symantec's 5 million number is right, the fact that malware keep showing up on the market is disturbing.

      To be fair, this does not look like Malware at all.

      For instance, I'm looking at the game called 'Balloon Game' by Ogre Games, which they say is malware. By downloading the application, you're agreeing to the fact that it can read your phone state and phone identity, you're agreeing that it can use the internet, and you're agreeing that it can install shortcuts on your home screen.

      The application wants to know my unique IMEI number? or my Mac address? Whoop di doo. I really don't care about that. And yes, it has access to the internet, so it can serve me ads, send info about me, and possibly (according to Symantec) update its own code in real time.

      But even if it can update its own code in real time, it can't change its permissions in real-time (it doesn't have the permissions for that), so it's still sandboxed in the permissions I gave it originally. So what's the problem here? What other "sensitive" information is it leaking out? Does this application go against anything in the Google's Market Terms of Services in any way? No, it doesn't. Only Apple has inane Terms of Services about not being able to load code dynamically from the internet.

    5. Re:Google Needs To Get Their Ass In Gear by VortexCortex · · Score: 3, Funny

      Hold your tongue and say Apple...

    6. Re:Google Needs To Get Their Ass In Gear by Telvin_3d · · Score: 4, Insightful

      That assumes that the average consumer can or should be able to make intelligent decisions about "who he trusts to review and approve apps". In reality it would be the malware company with the biggest marketing budget. The idea that a consumer should first spend weeks getting up to speed in the mapping or racing simulator communities before they can safely try out a couple apps is ridiculous. What you would get instead is friends recommending friends, and all that means is that every person who gets tricked they immediately recommend a few friends to download the same BS.

      Because the question in question is not "who can *everyone* trust?", the question is "who can everyone trust not to serve up malware". That is a much easier question to answer. And I think "big company with a lot of resources and a large vested interest in not serving me malware" is a pretty good answer to that question.

    7. Re:Google Needs To Get Their Ass In Gear by fluffy99 · · Score: 4, Insightful

      To be fair, this does not look like Malware at all.

      Hijacking your browser homepage, adding shortcuts to the desktop,stealing the imei and imsi (sufficient info to clone your sim card) ,copying your contacts,etc certainly counts as a trojan. Did you bother to read the symantec description?

      Sure a smart user might notice the excessive permissions but the average user just hits okay and doesnt even read the list.

    8. Re:Google Needs To Get Their Ass In Gear by fluffy99 · · Score: 3, Informative

      Perhaps Symantec are flagging it as malware because it is using permissions that the app clearly does not need, and it is just some rookie developer that has permission code copied in from some other site?

      You could try clicking the link in the article and see why. http://www.symantec.com/security_response/writeup.jsp?docid=2012-012709-4046-99&tabid=2

      Or just be lazy like the rest of the slashdot heard.

    9. Re:Google Needs To Get Their Ass In Gear by stephanruby · · Score: 3, Informative

      No, it's flagging it as "Malware" because it wants to you do the following as their solution for removing the so-called "Malware". Note how they conveniently left the simplest instructions for uninstalling the application all the way at the bottom of the page (where almost no one will see it).

    10. Re:Google Needs To Get Their Ass In Gear by inglorion_on_the_net · · Score: 3, Insightful

      I've always thought that apt (apt-get, aptitude, Debian) has the right solution to this.

      You get your software from a repository, and only software that is approved by the maintainers of the repository gets in.

      Then, _you_ get to choose which repositories you trust.

      That way, you don't have to judge the quality of all software yourself. You can leave that to the people who maintain the repositories. They will build up reputation over time, and you can go with the ones that have a good enough reputation by your standards.

      A walled-garden app store like Apple's basically implements the first part of this. This is fine for a lot of people.

      To also cater to those who want more freedom, without opening the flood gates, all you have to do is allow them to shop at other app stores, as well.

      --
      Please correct me if I got my facts wrong.
    11. Re:Google Needs To Get Their Ass In Gear by symbolset · · Score: 5, Interesting

      When netbooks came out they delivered remarkable utility with long battery life in a tiny package for low cost - using Linux and small SSD media. The netbook met a need for low-cost compromised UI with good performance. Then Microsoft convinced all the Linux netbook vendors to convert back to XP, consuming more storage (and driving the cost up) and delivering less-adequate performance. They sold more units, and lost money on every one. And then there was the crippled versions of W7 thing with even higher costs as the cost of full laptops dived below the price of netbooks. And the netbook market crashed because nobody was going to go back to the cheaper, quite awesome Linux variant when they could sell $300 laptops instead. But a funny thing happened. The price of a laptop also fell in response to this netbook threat - from $900 to under $300. Microsoft successfully killed the netbook by cutting the throats of their PC OEMs with budget laptops.

      People forget that between the netbook and the tablet was a Smartbook - invented by Asus and showed briefly in 2009 at a summer trade show - and then suddenly yanked in mid show. It was a ARM/Linux platform. The very next week a very nervous looking Jerry Shen flanked by Steve Ballmer and a member of Microsoft Legal was talking up Asus W7 platforms on a stage in Taiwan. He seemed to be sending out very stressed body language - something like "help me".

      So now we have ARM tablets, mostly thanks to Apple's huge margins and lack of commitment to the Windows ecosystem enabling them to innovate. But the netbook story isn't going to play out here again. The CE vendors are in this game now and Microsoft doesn't have the leverage over Samsung and HTC that they had over the PC vendors. The CE vendors can't make Apple tablets: only Apple can do that. So they're going to do the thing they CAN do, and make Android tablets as best they can. And they do. And they rock. And Google does the ecosystem thing for them, with 250M units in the field the developer need not worry about there being a market for his app if it's any good. With hundreds of thousands of apps customers need not fear the thing won't do what they want - in fact, if you've bought it for your phone you don't have to buy it again for your tablet. And some of the apps - particularly games - are quite incredible on a device with all-day battery life. And things like Kindle app of course still give you access to all the things you've bought through there too.

      The new crew, the CE giants, the Samsungs and HTCs are also the ones burned on Windows Phone and buying back their stock thanks to Nokia's preferred standing - so they're not going to push for WoA. Neither are the PC OEMs, once they find out Nokia got early access and help, and they're required to include software with Nokia branding on it in their PCs.

      WoA is going to try to step into this with no apps, a rejected WP7 UI and a general distrust of Microsoft, and try to make a go of it. Maybe even without multicore. They're going to have to acquire HTC to make that happen, because without something on that scale they got nuthin.

      This is starting to look like the end of the beginning.

      --
      Help stamp out iliturcy.
    12. Re:Google Needs To Get Their Ass In Gear by hey! · · Score: 3, Insightful

      That assumes that the average consumer can or should be able to make intelligent decisions about "who he trusts to review and approve apps".

      Not really. It assumes *some* consumers are able to make intelligent decisions and that there is benefit to addressing their needs and costs to sweeping them in with consumers who are less savvy. By that reasoning, there should be no *Consumer Reports* and we should rely upon the Consumer Products Safety Commission to make decisions for you.

      In reality it would be the malware company with the biggest marketing budget.

      This is probably depends on the *kind* of malware. Take privacy intrusion. Privacy intrusion for collecting marketing data would surely be a problem, because it's legal. But it goes on anyhow, you just don't see it and it's not running on your equipment. The point of entry to the surveillance network is the retailer. Privacy intrusion for purposes of identity theft would not be a problem *for the certification system* because the "big marketing budget" provides a trail back to the perpetrators.

      The idea that a consumer should first spend weeks getting up to speed in the mapping or racing simulator communities before they can safely try out a couple apps is ridiculous.

      I'll ignore the various shortcomings of the scenario you propose and cut to the chase: The real issue with the system I proposed is that it cannot overcome impatience, and it conflicts with the needs of marketing, which exploits impatience. There's an app that's gone viral, but it hasn't been certified yet by anyone you've heard of. It might take weeks for the stodgy certifiers everyone uses to get around to examining the thing, during which you'll have to live without this app you feel you can't live without. So you choose to grant an exception, or worse -- to trust a dodgy certifier. In fact, the system I proposes creates a new avenue for social engineering attack in which malware authors entice consumers to trust a malicious certifier because they want their free game *right now*.

      So why do I think it's a good idea? Because my standard of success is different than yours. You want a system that will protect foolish people from their choices. I want a system in which it is *possible* to make and enforce good decisions. While I think it is unfortunate that fools are exploited, I see no way of protecting them absolutely without posing unreasonable restrictions of freedom.

      Because the question in question is not "who can *everyone* trust?", the question is "who can everyone trust not to serve up malware".

      Well, if you can answer that, you make those agents the *default* trusted authorities. The problem I have with platform-vendor-chooses-who-everyone-has-to-trust solution is that everyone is not the same. A hospital securing its mobile devices used in health care delivery is different from a teenager who is messing with his game console. People feel differently about privacy too, and their stance may vary depending on device. That teenager might choose different universes of apps for his game console and phone.

      The problem with the current system is that it relies on people being able to draw inferences about developer intent from specific permissions an app requests. How insane is that? Even an expert who understands what a permission *does* can't reliably anticipate everything it can *accomplish*, much less the *intent* of the developer in asking for it.

      --
      Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
    13. Re:Google Needs To Get Their Ass In Gear by Abreu · · Score: 3, Insightful

      Yeah, and 76 million Tamagotchis have been sold world-wide. That doesn't make it less of a fad.

      --
      No sig for the moment.
  3. Reaction by Overly+Critical+Guy · · Score: 4, Insightful

    For years, the Windows platform was mocked relentlessly as a cesspool for malware. It's interesting to see what happens when there is a lack of quality control from the platform vendor, which turned Windows into a complete mess of contradictory interfaces (even within Microsoft's own software), convoluted configuration settings, and a third-party market devoted to cleaning up viruses and spyware. Android seriously risks going down that path, if it's not there already. There has to be more control on the part of Google.

    Pushing back on that is a small contingent of techies who want to turn the smartphone into a PC. They like to cite the freedom to install anything they want, but the truth is that mainstream users wouldn't do so even if they knew how. Google needs to cater to the needs of the majority and not latch onto populist concepts sound good to tech crowds (e.g., "openness") but mean nothing to everyone else who just uses these things as tools rather than hobbies--especially when Google seems to have trouble following fundamental tenets of open source like source code access.

    Those 37 million iPhone sales over December reversed the 2011 Android surge. The in-fighting among Android vendors risks more forks like Kindle Fire, customized interfaces, and abandoned phones that no longer receive updates mere months after their release. Google, turn the ship around before it's too late! The carriers won't help you.

    --
    "Sufferin' succotash."
  4. Re:May have? by Overly+Critical+Guy · · Score: 3, Insightful

    From TFA:

    'Symantec estimated the impact by combining the download totals -- which the Android Market shows as ranges -- of the 13 apps, arriving at a figure between 1 million on the low end and 5 million on the high. "Yes, this is the largest malware [outbreak] on the Android Market," said Haley.'

    Even the most optimistic estimate is very bad.

    --
    "Sufferin' succotash."
  5. Indirectly related, but... by Anonymous Coward · · Score: 3, Interesting

    Apart from being somewhat annoyed about the greater difficulty of managing my smartphone when compared to my Linux boxes, I've been having a hard time selecting apps for it.

    Android market is not exactly friendly (is there a way to get larger fonts?) and I'd like to have a search by permissions. Recently, I wanted a mere notepad app -- no frills, no cloud, no nothing, just the note, but there's an "excellent" notepad app which requires you to join an online service. WTF!!!

    After finding 2 suitable apps, I would still need a bigger keys soft keyboard... again looking at permissions to avoid leaking unnecessary things.

    No wonder guys end up getting viruses... we need better ways to control our exposure. Then again Google's business depends on offering us what we want and thus they need to know that. But am I giving my data only to Google? I wonder where my accounts and their details end up going...

    1. Re:Indirectly related, but... by purpledinoz · · Score: 4, Informative

      Root your phone and use Droid Firewall. All apps by default have no network permissions. Once it's setup, it works really well.

  6. Re:No risk for me by WhitetailKitten · · Score: 4, Interesting

    This is what I came here to say. If you think that those apps are legitimate or at least only a positive, you are either very desperate, underage, or a moron of the highest order. In the case of the first, I'm sorry you don't have the brains to find actual free porn/cheesecake pics, in the case of the second you're not clever enough to ascend to the next level of porn, and in the case of the third your phone is too smart for you, please take it back.

    On a slightly different topic, since I might as well go all out in insulting average non-computer-savvy people for the crime of not spending their life like pasty-faced Anonymous Cowards in front of the cool glow of a monitor in their basement, I remember an early app in the Android market that was literally a tithe calculator. I'm GUESSING this was someone's first app or otherwise a test app by someone learning to program, because I actually downloaded it a second time after an update and the interface became slightly more refined (with a background picture instead of a flat colour and so on), and I'm not particularly here to mock the author of the app so much as any target audience members that might exist.

    The app had a prompt for you to enter how much your annual income was, and then a 'go' button that returned (income/10) as the amount you needed to tithe. In the event that you belong to a church that receives tithes to support it, I'm very afraid if you need a smartphone and a custom app in order to divide a number by ten. The app did exactly what it said on the can, but by FSM I hope nobody was browsing through the Android Market and went "Oh! That's exactly what I need!"

  7. Well combine this with googles other news by gearloos · · Score: 3, Interesting

    Well, combine this with Googles recent news of privacy policy changes and Android's shine really is fading fast. I hate Apple, not for the products, I love Macs. It's the overused domination attitude I just can't deal with. So, that said, what's left? Win phone? Omg no. Maybe RIM and Nokia still have a niche after all... Just something to consider.

    --
    "Computers are a lot like Air Conditioners" "They both work great until you start opening Windows"
  8. Apple Haters ignore the fact they are more guilty by SuperKendall · · Score: 5, Insightful

    foxconn factory workers very satisfied: 100%, with no dissent! amazing.

    Who makes your Android phone?

    Some company that cares even LESS for their workers. At least Apple is trying to help and improve things, but China has a very servile culture embedded that has been pushed on them for many generations. They have a factory culture that has been as it is for a long time now and change is not instant.

    So every dig you take at Apple and Foxconn labels you a dirty hypocrite if you use any electronics whatsoever, because even more people suffered for your device to be made...

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
  9. Re:May have? by VortexCortex · · Score: 3, Funny

    "In other news, security research firm says they've found alarming evidence of their own relevance.
    Details at 11"

    That's 5:00 you non-binary-reading troglodytes. I suspect next I'll hear a story about how useful rats are at guarding cheese.

  10. Re:May have? by icebike · · Score: 4, Funny

    And of course NONE of the anti-virus or malware scanners caught even One instance of this in the wild.

    SYMANTIC advertising their own uselessness.

    --
    Sig Battery depleted. Reverting to safe mode.
  11. Re:No risk for me by symbolset · · Score: 3, Interesting

    I'm not sure how, but you've hit the crux of it. With Windows, we expect this "blame the user" scenario because we've been trained to expect it. We were hoping for better with Android. But there are just so darned many apps now to vet.

    Maybe a second level of "hey, these permissions are really loose and align with known malware. Are you really sure you want to enable this app to upload all your files and your contacts list to any random website and dial 1-900 numbers to run up your phone bill?" consent might be required.

    Or maybe just triggers for additional inspection of apps based on required permissions. But that costs money, and somebody has to pay for that. Maybe a permissions cost matrix for uploading your app, to pay for the code inspection. That would encourage developers to require the minimum necessary permissions.

    --
    Help stamp out iliturcy.
  12. Re:May have? by symbolset · · Score: 5, Interesting

    BTW: Symantec is just now disclosing that their servers were hacked in 2006 (as far as they know - maybe earlier). They don't know how long the hackers have PWNed their network, how much control they had, or for how long - but they're quite sure the hackers have stolen some of their source code. They recommend that you not use / disable / uninstall some (most) of their software. Most especially including PC Anywhere, since apparently it has a vulnerability or "back door" that allows the hackers to remotely administer your PC from Anywhere - and has for the last SIX YEARS.

    I think I'm going to take Symantec's edicts with a grain of salt from now on, even if this is from a different group.

    --
    Help stamp out iliturcy.
  13. Why Am I Not Surprised by rhook · · Score: 5, Insightful

    Look at this list of infected apps.

    iApps7 Inc Counter Elite Force Arcade & Action
    iApps7 Inc Counter Strike Ground Force Arcade & Action
    iApps7 Inc CounterStrike Hit Enemy Arcade & Action
    iApps7 Inc Heart Live Wallpaper Entertainment
    iApps7 Inc Hit Counter Terrorist Arcade & Action
    iApps7 Inc Stripper Touch girl Entertainment
    Ogre Games Balloon Game Sports Games
    Ogre Games Deal & Be Millionaire Sports Games
    Ogre Games Wild Man Arcade & Action
    redmicapps Pretty women lingerie puzzle Photography
    redmicapps Sexy Girls Photo Game Lifestyle
    redmicapps Sexy Girls Puzzle Brain & Puzzle
    redmicapps Sexy Women Puzzle Brain & Puzzle

    These are all Facebook type games that idiots play.

  14. Re:No risk for me by anonymov · · Score: 4, Interesting

    I just really wish for a more fine-grained permissions system.

    I mean:

    full Internet access
    Allows an application to create network sockets.

    Wouldn't it be fucking nice if it only could have unchecked internet access to an explicit list of URLs and "full internet access" meant "initiated by user action"?

    Same for file system and for "Read phone state and identity" - 95% of apps in the market want the same permission.

    It just gets devalued, like UAC's very helpful and informative "Allow this program to make changes to your computer?" prompt (More details? Sure: "Origin: Hard drive on this computer"). With all kinds of "changes" and their frequency it's not hard to see why UAC is often turned off. WIth all kinds of "full internet access" it's not hard to see why permission page is just to click "Accept".

  15. Re:No risk for me by anonymov · · Score: 3, Funny

    Can your mom differentiate between a good URL and a bad URL?

    She can. Why shouldn't she? It's not like there are no bad URLs outside apps. It should be as much common sense as knowledge of mail frauds and con tricks.

    Delegating vetting of apps behaviour to end users is a fundamentally bad idea. It's a task that requires skills and experience, and you can't assume them in a consumer product. This is stuff that should be done by professionals in the supply chain.

    May be, though I, like many others, prefer choice. But why does that invalidate a need for better permission system? AFAIK, iOS basically permits applications to do whatever they want with internet, relying on vetting to weed out abuse - and it's not guaranteed to work. There already was a handful of examples, like Dolphin browser quietly sending every URL you visit to their server "to check compatibility with Webzine"

    You seem to be opposed to it only on "iOS approach good, Android approach bad" basis. I don't see anything wrong with requiring basic knowledge from smartphone users. Is "Don't install games that want to send paid messages on your phone" so much harder than "Don't put metallic tableware in the microwave"?