Slashdot Mirror

← Back to Stories (view on slashdot.org)

New Android Malware Uses Google Play Icon To Trick Users

Posted by samzenpus on from the protect-ya-neck dept.

An anonymous reader writes "A new trojan for Android has been discovered that can help carry out Distributed Denial of Service (DDoS) attacks. The malware is also capable of receiving commands from criminals as well as sending text messages for spamming purposes. The threat, detected as "Android.DDoS.1.origin" by Russian security firm Doctor Web, likely spreads via social engineering tricks. The malware disguises itself as a legitimate app from Google, according to the firm."

6 of 223 comments (clear)

  1. This is why you want a walled-off app store by Anonymous Coward · · Score: 1, Insightful

    Because people will download and run apps from that store.

    And there's little/no AV protection.

    1. Re:This is why you want a walled-off app store by Anonymous Coward · · Score: 3, Insightful

      Because people will download and run apps from that store.

      And there's little/no AV protection.

      There is very little AV protection against users. They are the weakest link, but we can't have successful software companies without end users.

    2. Re:This is why you want a walled-off app store by alostpacket · · Score: 4, Insightful

      Yes but this uses an official ICON. Clearly no way to forge that. I've never seen anyone think to use logos or icons for nefarious purposes before. Luckily I am protected here on my Windows 7 machine. I clicked an ad using the Windows 2000 theme that alerted me to major potential threats in my "regisetery"... Had a similar experience on my Macbook Air. Thank goodness for the altruism of all those interwebs ads and sites.

      In all seriousness though, this could be a problem for people who root/ROM and install their Google apps from sources other than Google. Granted, when you root/ROM you should be aware of the risks, but it still presents a small danger.

      Many Google apps however request permissions that need the app be signed with the same key as the ROM and/or the system key.

      See: http://developer.android.com/guide/topics/manifest/permission-element.html#plevel

      "signature"
      A permission that the system grants only if the requesting application is signed with the same certificate as the application that declared the permission. If the certificates match, the system automatically grants the permission without notifying the user or asking for the user's explicit approval.

      "signatureOrSystem"
      A permission that the system grants only to applications that are in the Android system image or that are signed with the same certificate as the application that declared the permission. Please avoid using this option, as the signature protection level should be sufficient for most needs and works regardless of exactly where applications are installed. The "signatureOrSystem" permission is used for certain special situations where multiple vendors have applications built into a system image and need to share specific features explicitly because they are being built together.

      --
      PocketPermissions Android Permission Guide
    3. Re:This is why you want a walled-off app store by erroneus · · Score: 3, Insightful

      Indeed this is the most significant truth of it all.

      In iOS land alone are users "not responsible for their actions." For people to go around installing malware on PCs is a known problem. Save MSIE vulnerabiilities enabling drive-by installations and program execution, people install malware on their own machines.

      Now if this story was about a vulnerability in Android devices which permitted this type of system compromise, we might have a much more significant story. But what we have, instead, is reaffirmation that with Android, users have freedom to install the software of their choice just as they have with MacOSX and Microsoft Windows and other Linux distributions. We also have the recognition that users are not invulnerable to attack because they are using something other than MS Windows.

      Is this a sign that Android has "matured"? No. iOS is pretty mature and does not exactly suffer from such attacks. (oh wait, yes it does!) It is a sign that bad-wetware has recognized that Android is popular enough and free enough to make its users a target. At the end of the day, of course, it is the users which are being targetted and their devices, software and data are the means and the objective of the attack.

      This story is useful in that it is important that everyone be aware of the risks of running any software, but especially software from dubious sources. But let's hope the real message is not lost in the hype and flag waving.

  2. I'm not sure you understand. by tuppe666 · · Score: 4, Insightful

    I know your trying to defend Apples "lets gouge our customers policy" by limiting customer choice (and competition) to Apple on its (not your) phone...but to do do so I think you need to understand that on Android you have to actually go into the settings and *enable* his voluntary, and have to agree to a warning screen...Apple users are do desperate to have this functionality they "Jailbreak" Apples phone, even though Apple have attacked their customers for doing so.

  3. Apple has only 1.6% Market share. by tuppe666 · · Score: 4, Insightful

    The iPhone is unsuccessful? Apple has 53.3% of the smartphone market:

    LOL in the US...worldwide it had dropped from 23% to 14.9%. This is original report for your figures http://www.kantarworldpanel.com/global/News/Apple-achieves-its-highest-ever-Smartphone-share-in-US they are on in a pdf but include figures like in Brazil Apple dropping from 3.2% to 1.6% while Android moves from 28.9% to 60.7% of the market.