More than 50 applications on Google's Android Market have been discovered to be infected with malware called "DroidDream" which can compromise personal data by taking over the user's device,
and have been "suspended" from the store.
Google removed the apps from the Market immediately on being alerted, but it is not clear whether it has removed them from devices to which they have been downloaded. As many as 200,000 Android devices could have been infected.
The revelation comes from Android Police, a news site on Google's operating system, which calls it "the mother of all Android malware", noting that its examination had found that it "steals nearly everything it can: product ID, model, partner (provider?), language, country, and userID. But that's all child's play; the true pièce de résistance is that it has the ability to download more code. In other words, there's no way to know what the app does after it's installed, and the possibilities are nearly endless."
Lookout, a security company, which in a blogpost lists the 50-plus apps discovered to be infected. (The list is also below, via Lookout.)
Smartphones running Google's Android software have become enormously popular and are reckoned to be close to taking over worldwide as the fastest-selling smartphone platform, ahead of Finland's Nokia. Its growth has been fuelled by the fact that the software is free to license, and for developers there is no charge or checks to putting apps on the Market – unlike Apple's iPhone App Store, which checks every app against a suite of tests for suitability before allowing it on its store.
That has led the Market to grow rapidly, but also makes situations like the latest one – which is not the first case of malware found on the Market – harder to avoid.
The malware was first discovered by a Reddit user, Lompolo, who spotted that the developer of one of the malware apps had also posted pirated versions of legit apps, using the developer name "Myournet". But two other developers' products have also been found to include DroidReam.
Lompolo noted that "Myournet" had "taken 21 popular free apps from the Market, injected root exploit [code] into them and republished". More worryingly, those had seen between 50,000 and 200,000 downloads altogether in just four days.
DroidDream contains code which can "root" – take complete control of – a user's decice, and send detailed information such as the phone's IMEI (International Mobile Equipment Identity) and IMSI (International Mobile Subscriber Identity) numbers and send them to remote servers. But as Android Police's team found, the code can go much further in rooting through a phone.
Update: details of how the root code works are here. Note that this is a "privilege escalation" attack - once the app starts it uses the fact that it has user privileges to jump out of its sandbox and root the phone.
It's a rather brutal reminder of the fact that Android's openness is both a strength and, at times like this, a weakness – though Google's rapid action, in which it pulled the apps from the Android Market within just five minutes of being alerted, is encouraging.
It now looks likely that security companies will begin to compete to offer antivirus and anti-malware products for Android devices – which, given its rapid growth, could prove a fertile area for them with PC sales flat.
If you have downloaded any of the apps below, you should contact your phone company.
Full list of infected applications published by "Myournet": • Falling Down • Super Guitar Solo • Super History Eraser • Photo Editor • Super Ringtone Maker • Super Sex Positions • Hot Sexy Videos • Chess • 下坠滚球_Falldown • Hilton Sex Sound • Screaming Sexy Japanese Girls • Falling Ball Dodge • Scientific Calculator • Dice Roller • 躲避弹球 • Advanced Currency Converter • App Uninstaller • 几何战机_PewPew • Funny Paint • Spider Man • 蜘蛛侠
Full list of infected applications published by "Kingmall2010″: • Bowling Time • Advanced Barcode Scanner • Supre Bluetooth Transfer • Task Killer Pro • Music Box • Sexy Girls: Japanese • Sexy Legs • Advanced File Manager • Magic Strobe Light • 致命绝色美腿 • 墨水坦克Panzer Panic • 裸奔先生Mr. Runner • 软件强力卸载 • Advanced App to SD • Super Stopwatch & Timer • Advanced Compass Leveler • Best password safe • 掷骰子 • 多彩绘画
Full list of infected apps under the developer name "we20090202″: • • Finger Race • Piano • Bubble Shoot • Advanced Sound Manager • Magic Hypnotic Spiral • Funny Face • Color Blindness Test • Tie a Tie • Quick Notes • Basketball Shot Now • Quick Delete Contacts • Omok Five in a Row • Super Sexy Ringtones • 大家来找茬 • 桌上曲棍球 • 投篮高手
Posts
No comments:
Post a Comment