Slashdot Mirror
More Malicious Apps Found On Google Play
suraj.sun writes "We've seen quite a few Android malware discoveries in the recent past, mostly on unofficial Android markets. There was a premium-rate SMS Trojan that not only sent costly SMS messages automatically, but also prevented users' carriers from notifying them of the new charges, a massive Android malware campaign that may be responsible for duping as many as 5 million users, and an malware controlled via SMS. Ars Technica is now reporting another Android malware discovery made by McAfee researcher Carlos Castillo, this time on Google's official app market, Google Play, even after Google announced back in early February that it has started scanning Android apps for malware. Two weeks ago, a separate set of researchers found malicious extensions in the Google Chrome Web Store that could gain complete control of users' Facebook profiles. Quoting the article: 'The repeated discoveries of malware hosted on Google servers underscore the darker side of a market that allows anyone to submit apps with few questions asked. Whatever critics may say about Apple's App Store, which is significantly more selective about the titles it hosts, complaints about malware aren't one of them.'"
>complaints about malware aren't one of them
So the ones that raid your contacts and send the information to persons unknown are fine?
Why can't they offer a vetting process for apps? Not everything needs the "Google seal of approval", but having a google verified or trusted apps icon appear on an app might alleviate some of the problems, or at least the perception of the google market store (I can't call it google play store, it's just stupid) being a haven for malware and cheap ripoffs.
In fact, this could be a policy that a third party app store could institute. It would be interesting to see it happen, as they could potentially become more popular than Google's own store.
"some of App Store's shiniest celebrities are among those that beam away your contact list in order to make hooking up with other friends who use the app smoother. " http://m.gizmodo.com/5885321/how-iphone-apps-steal-your-contact-data-and-why-you-cant-stop-it
I think it's worth noting that the new malicious applications found by McAfee researchers were video trailer applications that overtly requested the READ_PHONE_STATE and READ_CONTACTS permissions at install time.
While it's clear that users have limited comprehension of the permissions requested at install time (for instance see: Android Permissions: User Attention, Comprehension, and Behavior) it is rather suspicious that a trailer application require access to your contact list. From the sounds of it the malware doesn't do much other than siphon off your contact list & some identifying information (Android ID & phone number).
Should it be removed from the Android market? Yes. Is it the best example of subversive Android applications? Probably not.
Not only have there been numerous problems with malware on iOS, a recent study (too lazy to search for it) randomly selected a bunch of apple-vetted apps and apps from a jailbreak-only iPhone app store, and found that a larger percentage of apple app store apps are malware than ones from the third-party unvetted store...
One argument is that this is simply a market choice, A) a free and open market that is easy to upload malware, or B) a closed market that is difficult to upload malware.
Perhaps, but I believe you can have both. If a third party was able to find this malware in the market, why can't Google? Google simply needs to make this a priority, and do a better job. Scanning and making sense of the data really is their core strength.
Apple: App Access to Contact Data Will Require Explicit User Permission
I guess you forgot that part.
And the part about how these apps weren't "malware", irrespective of whether they were doing something previously allowable without explicit user permission.
So it's not at all accurate to say that it's "happening on the App Store too".
Where is their incentive?
I tend to agree, not at least doing automated scanning is irresponsible. At least make an attempt..
I would also hope there is some prosecuting involved when these apps are found and removed.Otherwise, they will just try again.
---- Booth was a patriot ----
Yes, there's a significant problem here.
The problem is that Google does NOT like free apps. Google make their money from advertizing, and on Google Play they're actively hiding whether are apps paid for by advertizing. This means that FOSS is having a hard time there. And cheap rip-offs of various kinds are having a field day. Once a thriving community of rip-off artists have been gathered bad things(tm) happen (even more).
By the way. Congratulations, the professional anti-Google scaremongers found a semi-reasonable point to criticize. Well done.
And just enough off-center from the real problems not to bother your Corporate Overlords, nice.
Would it have killed all the "security researchers" who wrote or compiled all the articles behind all the links in this story to maybe list the apps that have been found to have trojans?
I mean, Android users might find that information useful and it might actually help minimize the damage from these apps.
Right now, it's like a news story that tells us "Three common home products have been proven to cause deadly forms of cancer" without mentioning which products they are.
You are welcome on my lawn.
"Well, if you are into the whole social network hype, you kind of deserve to get tracked and ripped off. You basically asked for it yourself."
And if you got a telephone, you deserve to be called by telemarketers and scam artists. And if you got a car you deserve to be carjacked. And if you have electricy you deserve to be electrocuted.
You basically asked for it yourself. Those are all possible consequences of choosing those products.
Stay in your luddite cave and disconnect. Toodles.
Same reason their customer support is shit and your only point of contact really is a dumb messaging board service. Google, imo, isn't that bothered about looking after people.
I don't think that anyone said that linux with a dumb user is secure. What was the point was back then you could install malware on a windows computer simply by connecting to it, loading a malformed picture, or any other number of things that even a smart user couldn't prevent.
Now how many of these apps can self install on an android phone without the owners knowledge? how is that any different that say, around the year 2000 when your mom/grandma/uncle/younger brother would just click and download and install any link/program they found on the internet? People really need to realize that these smartphones really are just tiny portable computers that happen to have phone programs installed by default, all the same things you have to do on your computer to keep it safe apply on them as well.
All of the above was encrypted with a Quad ROT-13 method. Unauthorized decryption is in violation of the DMCA.
Google's always been awful about not checking its ads for malware, so I see this as no big surprise. In my experience, the text links at the top of my Gmail page have been about 95% scam and malware sites, akin to the stuff I find in my spam box. (I've since installed a browser extension to disable such ads.) Google has thus shown a previous utter disregard for ensuring the sanitation of their profit centers, so I fully expect this new "app store" (no, I don't care that it's called "Google Play;" I'll call a spade a spade, thank you very much) will be much the same until Google gets sued or some such. (In other news, I seem to recall them being sued in Australia or the EU for their fraudulent ads.)
H'm the freedom to do whatever I want within the law. With the risk of something possibly going wrong.
Or
Being ruled with an iron fist. With little chance of anything going wrong. But no guarantee.
a) They'd have to have such a deal with all carriers for it to be feasbile
b) Not everybody *HAS* a carrier (think: tablets/wifi)
c) Who cares if the carriers have app stores?
I think that perhaps instead of carrier, you meant manufacturer? Even in that case you've already got the "amazon app store" etc though...
not at least doing automated scanning is irresponsible
How would you solve the Halting Problem to make automated scanning feasible?
If you use Facebook on your phone, you should be happy for Mark Zuckerberg to have access to all your private phone numbers and other data. You'd have to be blind to not know by now that Facebook doesn't care one whit about your privacy, so by using their app on your phone you should expect they would grab all the data they can.
I'm not sure why this has quickly devolved into a discussion over whether Android or Apple is less safe in regards to the apps available for it. A far more useful discussion would be how can we as end users protect ourselves from these practices. I like to think I'm a cut above the average person (not necessarily the average slashdotter) by being somewhat selective about the apps I install, paying attention to the permissions they request, and running an iptables based firewall to whitelist the apps that I allow network access to. Even with that though I can't claim to be immune to downloading an app that has some malware on the backend. I've resisted the idea of antivirus/antimalware programs so far as I find that my phone's resources are quite limited enough as is. I'm not all that concerned about premium SMS either as I run a prepay sim with no extra funds on it. Can anyone point out any other obvious practices I may be missing?
It's about time Google is getting serious competition from competitive android distributions. I for one would like very much to be able to store my data on non-google servers (preferably my own) and use a competitors apps store that is trustworth and not laden with (google) ads. It works for Linux, it should work for Android. It's about time we separated the software from the hardware and the service providers. Anti competitive pacts like the US phone companies almost certainly seem to be having should be looked into. It's virtually impossible to get a decent phone separate from an affordable plan there, even tho there will be plenty of people wanting to just purchase a phone and get a cheap plan with it, that suits their needs. This is all a tinfoil hat size of a conspiracy that seems to be going on between the phone vendors and the operators, making free choice for buyers impossible.
I was promised a flying car. Where is my flying car?
What would outright suck however is Google becoming more like other stores and putting a delay between upload and release. I LIKE the fact that I can rapidly upload updates to my apps. There have been occasions where I've turned around an update in under 30 minutes. If I tried to turn around a fix on any other store, e.g. Amazon's or the Blackberry store I'd be looking at the better part of a week for an update to appear. I have no idea what the hell they do in that time but somehow I doubt they're looking for malware or would be capable of spotting it even if it were there.
The old "those who trade freedom for security, soon have neither" springs to mind.
Because believe it or not, iOS and OSX are not immune to malware, virusses and trojans. They just are more hidden, so that when it happens, their users are less prepared for it.
Android is open, anyone can make an app. It is a free market. Apple is closed, your app has to be be vetted. It is a closed market. Closed markets are ALWAYS easier and safer then free markets. But the vetting takes place outside your control and you never can tell in advance when it will turn out to be harmful. Take Sony refusing to allows multiplayer for ME3. The windows platform for that game could never have such a blockage. But then, there is zero quality control for Windows games.
You just got to search the Android market to see a LOT of crap, not just malware but apps that are valid enough as code but the idea they try to push is a scam itself. Pyramid schemes, credit rating boosters, signal, battery, memory boosters. But these same applications exist for Windows. They do NOT appear on the game consoles. But what do you rather have? The save walled garden or the free wilderness?
To be honest, most of the time the save walled garden. It is just easier and live is already to complicated. The sad thing however if you are in that walled garden to long, the wilderness might have disappeared and you no longer have an option.
Think Amazon destroying the physical bookstore so that when they next delete a book, there is nowhere else to get it. If Apple owned 99% of the market, there would be no more malware. But what then would be defined as malware would be Apples definition and not yours. And I don't like that idea one bit.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
The problem is "security" companies who make "proof of concept" code and release it into the wild . Instead of helping the companies with which they've found the flaw. This reminds me of the mob asking for protection money they release the code then they say look look android isn't secure UNLESS you buy our product.
I'm still chatting with my Nokia 8250. No, seriously, I do.
Um, I don't know about your phone, but my HTC Sensation doesn't have any pre-installed Facebook apps that I could find. It has some crappy "Friend Stream" widget that you can install on one of your main screens if you choose, but that's not set up by default, and it only runs if you install it (it's a widget, not an app). I never installed mine, so it never runs. Besides, to allow it access to your Facebook account, you have to actually configure the widget with your FB account info. It can't magically figure out your FB username and password.
Avast for Android.
A/V, malware scanning, limited firewall, and theft protections.....
I use it on every device.