Android Botnet Infects 1 Million Plus Phones

Trailrunner7 writes "Up to a million Android users in China could be part of a large mobile botnet, according to research unveiled by Kingsoft Security, a Hong Kong-based security company, this week. The botnet has spread across phones running the Android operating system via Android.Troj.mdk, a Trojan that researchers said exists in upwards of 7,000 applications available from non-Google app marketplaces, including the popular Temple Run and Fishing Joy games." Update: 01/19 12:54 GMT by S : Changed summary to reflect that these apps didn't come from Google Play.

Comments

Excellent fact-checking as usual

[Macthorpe]

http://www.zdnet.com/new-android-malware-infects-100000-chinese-smartphones-7000000497/

Not in Google Play at all.

Re:Excellent fact-checking as usual

[sjwt]

And excellent wording for FUD... after all "up to 1 million aliens *could* be controlling the worlds governments"

Re:Excellent fact-checking as usual

[SternisheFan]

http://www.zdnet.com/new-android-malware-infects-100000-chinese-smartphones-7000000497/

Not in Google Play at all.

Thank you! These 7000 plus apps were 3rd party apps that were not downloaded from Google Play.

Re:Excellent fact-checking as usual

[AmiMoJo]

Since most people are too lazy to RTFA the malware infected apps are actually on China Mobile's own app store, not Google Play.

It looks like another case of a company thinking "everyone has an app store, we should get one!" but not realizing there is a need to actively police it.

Re:Excellent fact-checking as usual

[Anonymous Coward]

Everybody knows Chinese people always download from Chinese pirate sites. You can get everything for free. Including infected.

Re:Excellent fact-checking as usual

[Anne Thwacks]

Not if the Zombies have a say in it!

Re:Excellent fact-checking as usual

[sjwt]

Only if you fail to lead the plant army correctly!

Re:Excellent fact-checking as usual

[Anonymous Coward]

Doesn't that imply that if Google-Play/Android was a walled garden like iPhone/iTunes this would not have happened?

Um, no.

Just because China Mobile's (cr)app store isn't doing its job doesn't mean Google should become as draconian as Apple in this regard. People have a choice, and if they are willing to download from a poorly regulated source, and are willing to endure infections just so they don't have to pay for their apps, that's their business. I certainly hope their data plans are unlimited.

Re:Excellent fact-checking as usual

[mysidia]

The virus/malware authors though, might not appreciate you pirating their software, and may sue as a result....

Re:Excellent fact-checking as usual

[jareth-0205]

You did not answer the question about walled gardens. In fact, you gave a hint that the absence of a walled garden *did* exacerbate the problem.

Probably does. The price of freedom is that people are free to install malware.

Re:Excellent fact-checking as usual

[koxkoxkox]

Chinese users often have no choice, as Google Play is often not present in the phone. Manually installing it is quite complicated.

Re:Excellent fact-checking as usual

[rjr162]

The original article they linked to iirc was some smaller website that did list Google play

Re:Excellent fact-checking as usual

[arth1]

Title: 1 Million+
First line of summary: Up to a million

Yes, standard /. fare lately. Not only is it meaningless (and thus not nerdy - the details are more important than the big picture to a nerd), but the editors contradict themselves and come across as both careless and ignorant.

Re:Excellent fact-checking as usual

[Nerdfest]

The price of Apple's walled garden is that they get to define what is malware. (So far, things like apps to teach children how to program, games that are too 'political', porn, Android magazines, etc). I'll take my chances, thanks.

Re:Excellent fact-checking as usual

[Anonymous Coward]

Probably does. The price of freedom is that people are free to install malware

... which is not what 99% of the population wants.

This malware problem has caused a lot of the shift away from Wintel PCs, and there's no reason the same can't happen to Android.

Re:Excellent fact-checking as usual

[Sigg3.net]

Well, I for one, welcome our hypothetical overlords!

Re:Excellent fact-checking as usual

[BasilBrush]

Damn it! iPhone is once again not affected. One of these days I'll get the chance to welcome the malware overlords!

Re:Excellent fact-checking as usual

[Anonymous Coward]

Not in Google Play at all.

Not this time.

But there were cases of malware in the official Google store as well.

Re:Excellent fact-checking as usual

[DerekLyons]

It looks like another case of a company thinking "everyone has an app store, we should get one!" but not realizing there is a need to actively police it.

Yet, in the past, Slashdot has held that's not a bug, but rather is a key *feature* of the Android ecosystem - the ability to leave the walled garden and wander in the wilds.

Re:Excellent fact-checking as usual

[Anonymous Coward]

Don't forget, APL's already allowed actual malware onto their store with at least a few thousand installs, before Charlie Miller came out and announced to the world that his app was whitehat malware (but malware nonetheless).

Makes you wonder how many applications are malware on the store when there's only "one pair of eyes" that can look at the apps easily. I mean, these apps could easily abuse the same jailbreak bug to install themselves...

Re:Excellent fact-checking as usual

[Anonymous Coward]

And it still is?

Consider there are plenty of application stores like GetJar, Amazon, MiCandy that have never suffered an infection because they're reputable...

It's like you go to a drug dealer cartel and not expect them to have drugs or weapons. Some people can't be trusted to keep you safe.

Re:Excellent fact-checking as usual

[SternisheFan]

Damn it! iPhone is once again not affected. One of these days I'll get the chance to welcome the malware overlords!

I wouldn't act so apple-ey smug, if I were you. Apple iPhones have infected apps out there in the wild also, same as Android. If you jailbreak your phone and download apps from outside the apple store, you too will be risking getting malware.

Re:Excellent fact-checking as usual

[alostpacket]

The actual original article (Xinhua via Google translate)

http://translate.google.com/translate?hl=en&sl=zh-CN&tl=en&u=http%3A%2F%2Fnews.xinhuanet.com%2Ffortune%2F2013-01%2F11%2Fc_114339598.htm

The "Security researchers": Jinshan networks / Kingsoft (DuBa)

http://translate.google.com/translate?hl=en&sl=zh-CN&u=http://www.ijinshan.com/&prev=/search%3Fq%3DKingsoft%2B(DuBa)%26hl%3Den%26safe%3Doff%26client%3Dfirefox-a%26hs%3DtyH%26tbo%3Dd%26rls%3Dorg.mozilla:en-US:official%26channel%3Drcs&sa=X&ei=xMn6UMCuGtCM0QGMyIDIDg&ved=0CEAQ7gEwAQ

Re:Excellent fact-checking as usual

[Lussarn]

Or you could read the reviews in the play store before downloading. If the app is full of crap there are 500 persons telling you so. Not really hard...

Re:Excellent fact-checking as usual

[screwdriver]

I love it! I'm sure they made damn sure apps like orbot (tor) are not available, but they could care less if malware gets through.

Re:Excellent fact-checking as usual

[tepples]

Amazon's store works on many devices.

In which countries? The last time I checked, paid apps on Amazon Appstore were available only to billing addresses in the United States of America.

Re:Excellent fact-checking as usual

[Anonymous Coward]

[Citation Needed]

Due to the destruction of the JB scene, no Apple device made since 2010 that runs iOS 6 can run apps outside the App Store. Maybe an iOS dev could have a beta app out that might do some damage, but people would be knowingly installing it.

With over five years of not even a single malware issue in the wild, iOS has showed that it is the most secure OS in history.

Re:Excellent fact-checking as usual

[Plumpaquatsch]

http://www.zdnet.com/new-android-malware-infects-100000-chinese-smartphones-7000000497/

Not in Google Play at all.

Considering those are all Chines phones, that's not really surprising. Most "Android" phones sold in China don't have access to Google Play.

Which is the real problem here: Google has walled them out of their garden and forces them to go to even unsafer places.

Re:Excellent fact-checking as usual

[ChatHuant]

The price of freedom is that people are free to install malware.

Which makes Windows the freest platform of all by far.

Re:Excellent fact-checking as usual

[Clsid]

Well, it's not like you have a choice. Google Play does not work in China, as well as usual stuff you would expect to work like Youtube, Facebook, Twitter, Google Drive and even Gmail. So you have alternative stores that provide apps, but you also have mobile antivirus software in China which is what most sensible people would use.

Then again, with China Mobile alone we are talking about 670 million users compared to 100 million users that AT&T has. It is quite impressive that there aren't any more infections.

Re:Excellent fact-checking as usual

[Clsid]

In this case, either China Mobile provides the store or they include a third party since Google Play does not work in China. I would actually feel safer to use something from China Mobile given they are the largest carrier, but this incident proves that if you are in China, you are better off using a Windows Phone or an iPhone, even if they are outrageously expensive over there.

Re:Excellent fact-checking as usual

[thegarbz]

The only irony is that the readership of Slashdot is well in the affirmative for freedom of citizens, gun ownership, freedom from censorship and tyranny, yet some how manages to be split on the idea of having some corporate entity decide what can and can't do in the name of malware prevention.

Re:Excellent fact-checking as usual

[S.O.B.]

Various incarnations of MVS have been running since 1974. No viruses or malware reported. Five years barely even registers on that time scale.

Real men run their operating systems on big iron.

Re:Excellent fact-checking as usual

[BasilBrush]

Apple iPhones have infected apps out there in the wild also, same as Android.

No, not the same. A drop of water, long since evaporated is not the same as a bucket of water.

If you jailbreak your phone and download apps from outside the apple store, you too will be risking getting malware.

In further news, condoms are useless if you cut the ends off them. Doh!

Re:Excellent fact-checking as usual

[tlhIngan]

The only irony is that the readership of Slashdot is well in the affirmative for freedom of citizens, gun ownership, freedom from censorship and tyranny, yet some how manages to be split on the idea of having some corporate entity decide what can and can't do in the name of malware prevention.

I think it's due ot direct exposure. Most of those rights get abused by an irresponsible few (who often ruin it for the responsible many).

Very few /.'ers have experienced the tragedy that strikes from say, irresponsible gun ownership (like loaded storing guns in an oven, or on the coffee table accessible to any kid walking by, nevermind mass shootings), or lived in countries where censorship and tyranny are common (because they won't be able to get /. typically), and such.

However, most /. users HAVE experienced the direct effects of malware - spam, DDoS attacks, etc. And they know most users don't care about computers enough to maintain them or such. Being somewhat pragmatic people, learning all about the ins and outs of a computer is similar to learning the ins and outs of a car and eventually being able to be a shadetree mechanic (which we know isn't true of the vast majority of drivers). Also being pragmatic, said /. users don't really want to travel around to their family member's houses and fix their computers, either, so they wish to have a simple solution to save themselves and do everyone else a favor.

Probably also due to the fact most /.'ers think everyone else is similar to them with similar goals - if you own a gun, you'd take care in storing it and ensuring you're trained and licensed and all that. Or that you'll watch what you say so that it's defensible (also why most have a disdain for those who publish their whole lives online and seeing it bite them in the ass because it gets used as evidence or reason to be denied employment).

Basically the /. profile is that of a reasonably responsible person who has enough common sense to realize when things are dangerous (e.g., loaded guns in the house) and avoid them as much as possible.

Not from Google Play

[Anonymous Coward]

Actual BBC story:"Trojan had been found in more than 7,000 apps downloaded from _non-Google-owned_ stores."

It's a bit weird that neither the submitter nor the threatpost author thought it strange that thousands of popular apps on Google Play would include a trojan that has been known about for over a year?

Re:Not from Google Play

[Savage-Rabbit]

Actual BBC story:"Trojan had been found in more than 7,000 apps downloaded from _non-Google-owned_ stores."

It's a bit weird that neither the submitter nor the threatpost author thought it strange that thousands of popular apps on Google Play would include a trojan that has been known about for over a year?

It's a bit ironic that fAndroids, who have been criticising Apple's walled garden for years, are now criticising other Android users for making full and enthusiastic use of the freedom of the Android platform to download apps from anywhere they damn well please rather than only dealing exclusively with Google owned or Google sanctioned stores. Not to say that walled gardens are a good thing but this discussion is nevertheless quite amusing since it tacitly admits that walled gardens, for all their other faults, are an efficient way to filter out malware. As long as there are other ways to download Android apps than from a walled garden of Google owned or Google sanctioned third party stores things like this will continue to happen.

Re:Not from Google Play

[berashith]

This is a simple case of "just because you can, doesnt mean you should". I like the OPTION of loading apps from anywhere. I also pay attention to what gets installed and where. I turn off the alternate installation locations unless I am actively installing something. The people who want pay apps for free just pay a price that isnt money, and their stupidity should have no impact on my ability to be allowed to use my device as I want. No need to force your draconian bliss on the rest of the planet.

Re:Not from Google Play

[Anonymous Coward]

fAndroids...are now criticising other Android users for making full and enthusiastic use of the freedom of the Android platform to download apps from anywhere they damn well please

I haven't seen anyone doing that.

Not to say that walled gardens are a good thing but this discussion is nevertheless quite amusing since it tacitly admits that walled gardens, for all their other faults, are an efficient way to filter out malware.

And a sledgehammer is also an amazingly efficient way of cracking a walnut. "All their other faults" is a nice way of glossing over glossing over the fact that the cons of a walled garden outweigh the pros.

Re:Not from Google Play

[peragrin]

As was shown in the 70's you never know that the source your using is actually trusted.

Just because the source is good doesn't mean the compiler was.

many an infected and ultimately untrustworthy app was been downloaded from google play. Google like apple though monitor them and updates get pushed through so widespread failures are rare.

Draconian bliss can be used for good. The trick is balancing out the Draconian rules with fairness.

Re:Not from Google Play

[berashith]

this is true, but there is a big difference in the monitored stores and the bootleg stores that people are getting infected in. The google owned store could have junk inserted from a bad compiler, where the chinese free stores have intentional malware inserted.

Re:Not from Google Play

[Anonymous Coward]

Can I as the original commenter take part in this second-guessing of my implied message?

I did not say "this only happened because the affected Android users did not limit themselves to the Google store" at all as you claim -- pretty bold of you to just say that when my message is clearly visible above... Also, nothing in my post was meant to "imply the criticism that if they had remained in the Google fold their phones would not have been affected" (in fact I don't even have a clear opinion on whether the open model or the Apple 'closed garden' model is better).

My only criticism was aimed at the shoddy reporting: It included a pretty big factual mistake. Mistakes sometimes happen, but this one made the story so unbelievable that it's hard to understand how both the article author and the submitter failed to apply some common sense and re-check the source.

Re:Not from Google Play

[alostpacket]

There's a difference between curated and walled.

Re:Not from Google Play

[Cinder6]

And a sledgehammer is also an amazingly efficient way of cracking a walnut. "All their other faults" is a nice way of glossing over glossing over the fact that the cons of a walled garden outweigh the pros.

That's rather subjective, isn't it? I would imagine that Apple's "walled garden" approach works just fine for most of its users. You do see a lot of complaining, but keep in mind that people are more likely to go to a forum to complain than to say everything's great.

For myself, as an iOS user, I have only been miffed with Apple's policies three times. The first was MyWi, but that is probably due more to the carrier; the second was Swype, but now that Siri's out I pretty much use voice dictation for my phone, and I can type surprisingly fast on my iPad; the third was when they wouldn't give Sparrow the push email privilege.

I did jailbreak my phone at one point. There were some neat things in Cydia, but many of them were surprisingly expensive. I wound up reverting to standard iOS for a couple reasons, but one of them was that those same neato tools (I only installed two or three of them) absolutely killed my battery life.

Computing Power

[MassiveForces]

Imagine if botnets were put to benevolent uses, like distributed computing projects. Seriously forget credit card data - nobody has any money these days. Process some folding at home and collect some Nobels.

Re:Computing Power

[Rockoon]

...the bot would at most be able to tap a percentile of the CPU's power.

10 percent of a million CPU's is still equivalent to 100,000 CPU's.

Re:Computing Power

[Anne Thwacks]

I thought for a minute you wrote forge Credit cards: The I remembered the Search for Expoitable Transaaction Information project. Yes, botnets really can work for the dark side!

Re:Computing Power

[Anonymous Coward]

Or generating massive rainbow tables...

Re:Computing Power

[Plumpaquatsch]

Imagine if botnets were put to benevolent uses, like distributed computing projects. Seriously forget credit card data - nobody has any money these days. Process some folding at home and collect some Nobels.

Yeah, sure. Drain some million Chinese guys phone battery, so somebody else can get a Nobel Prize.

A million bots! All on dialup!

[Let's All Be Chinese]

Alright, not exactly dialup. But close enough for making the comparison on slashdot.

Should be interesting, trying not to make too much of a mess to avoid running the bots out of traffic allowance and/or running up the punters' bills enough to notice something is amiss.

Is M-x tetris pirating?

[tepples]

In your correlation between rates of "software pirating" and security, do you consider the development and dissemination of free software workalikes of proprietary video games to be "software pirating"? I can think of a few companies that do. Yes, things like M-x tetris in Emacs are a sort of edge case, but defining the edge of discussion helps participants find common ground from which to start.

Don't want to BOINC and call 911 on one device

[tepples]

Imagine if botnets were put to benevolent uses, like distributed computing projects.

Distributed computing botnets would run up a CPU bill, causing the user to click "What has been using my battery?". That's why, for example, the Distributed.net client didn't get ported to PDAs and the like.

Re:Who did NOT see this coming?

[ravenlord_hun]

Let me know when you get SMS forwarding or time based caller blacklisting working on that phone.

Re:NOT AN INFECTION

[Gaygirlie]

It's NOT AN INFECTION when user willingly installs a malicious application and approves its permissions.

That's like saying that it's not an infection if you inject yourself with HIV because you knowingly do it -- obvious rubbish. OF COURSE it is an infection still. Especially when the malware - package is HIDDEN inside another one, so that when the user thinks he's installing one thing he's actually getting two things. You might have a point if the user knowingly installed a malware - package, but that's just not the case.

Learn the basics of compooters before you write something that stupid next time.

Indeed, mate, indeed.

Hong Kong-based security company?

[dgharmon]

Microsoft VIA Member

"Kingsoft Internet Security 9 Plus is a complete package with Anti-Virus, Anti-Spyware, and Firewall applications, providing a complete solution to protect your computer system against the latest online threats. link

Re:Hong Kong-based security company?

[Clsid]

If you think Kingsoft is a tool, think again. That company is owned by Lei Jun, which is like China's Steve Jobs. That guy is creating a complete hardware/software solution not unlike the iPhone, by heavily modifying Android. They are offering their new cell phones at a very competitive price in continental China and it's been selling like hot cakes.

Here is a good article about the guy http://www.forbes.com/sites/simonmontlake/2012/07/18/xiaomis-lei-jun-chinas-answer-to-steve-jobs/

Apple Hater, behind the times as usual

[SuperKendall]

So far, things like apps to teach children how to program, games that are too 'political', porn, Android magazines, etc

Perhaps the last two you might have something, but there is a slew of apps to help you actually program on the iPad/iPhone.

And of course you can always jailbreak. So on iOS, only the people who know what the risks are are exposed to them. That seems like a far more sensible layered security model than screwing over one million technologically inept people just because you are too lazy to jailbreak before accessing alternate app sources.