Slashdot Mirror
Google Pulls 500+ Backdoored Apps With Over 100 Million Downloads From Google Play (helpnetsecurity.com)
Orome1 shares a report from Help Net Security: Security researchers have identified over 500 apps on Google Play containing an advertising software development kit (SDK) called Igexin, which allowed covert download of spying plugins. The apps in question represent a wide selection of photo editors, Internet radio and travel apps, educational, health and fitness apps, weather apps, and so on, and were downloaded over 100 million times across the Android ecosystem. Lookout researchers did not name the apps that were found using the malicious SDK, but notified Google of the problem. The latter then proceeded to clean up house, either by removing the offending apps altogether, or by forcing app developers to upload an updated version with the invasive features (i.e.
the Igexin SDK) removed. "Users and app developers have no control over what will be executed on a device after the remote API request is made. The only limitations on what could potentially be run are imposed by the Android permissions system," the researchers pointed out. "It is becoming increasingly common for innovative malware authors to attempt to evade detection by submitting innocuous apps to trusted app stores, then at a later time, downloading malicious code from a remote server. Igexin is somewhat unique because the app developers themselves are not creating the malicious functionality -- nor are they in control or even aware of the malicious payload that may subsequently execute. Instead, the invasive activity initiates from an Igexin-controlled server."
What's the point of source material that doesn't include a list of the apps?
... IMHO these Apps should be named ...
FFS Google, how did you let it get this bad? I thought that you were supposed to be watching out for this kind of stuff. We need a "Install apps from the Google Play Store" toggle in the next version of Android. Default: OFF.
Only Google's homegrown spyware is allowed on my phone! None of this third-party spyware for me.
...mightn't it be useful somewhere to list the apps that were pulled, and or their authors?
-Styopa
So they once have flaws in their walled garden store that allow malware on to people's devices, then don't even tell them which ones they were. They have had flaws in the past, and who knows how many more are yet to be discovered.
While they do monthly "security updates" less than 1% of users actually get them in a timely manner most will never get them at all and you can forget about large OS updates.
One of these days some horrible malware is going to hit most of their users and once that happens, it will happen over and over and over again. Very similar to what happened with MS and windows xp in the beginning. Maybe then google will take security seriously and have a sane update model that won't leave their users screwed. Maybe. Probably not.
Their app store is riddled with malware and they won't identify the malware. That really engenders trust and makes me want to use their stuff.
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
Dumb ass users will complain that one of their favorite apps is gone and install it from 3rd party. And then complain that their phones are compromised.
sudo rm -r -f --no-preserve-root /
Possible nefarious behavior aside, this behavior is unacceptable in an "SDK". The developer/development team that created the application developed against a specific version of the SDK and tested against that. If an SDK hot-fixes, you've completely invalidated the testing for that application and possibly broken things in the application. Even if the only thing you're doing is fixing known bugs in the SDK, it's quite possible that the developers implemented code to work around those bugs and fixing it will cause those workarounds will now break (e.g. the API returns ERROR_002 for a certain condition when it should be returning ERROR_001. Problems like this are common in SDKs). So either they are:
1. Evil programmers who wanted to make your app do something unintended.
2. Incompetent programmers who could accidently make your app do something unintended.
Either option sucks.
Lgexin was a legitimate ad network at one point, but it contained an update mechanism which could be abused later (and downloading malicious components later was one way to evade Google's malware scanners). The apps are being removed/updated to prevent future abuse, not only to stop current abuse; The list of affected app is being witheld because not all of the apps/developers were malcious.