Millions of Android phone users slammed by malicious data theft app

“An app distributed by Google’s Android Market has collected private data from millions of users and forwarded it to servers China, validating Apple’s uniquely strong stance on mobile security in the iPhone App Store,” Daniel Eran Dilger reports for AppleInsider. “The exploit, tied to an app that appeared to simply load free custom background wallpapers, was downloaded ‘anywhere from 1.1 million to 4.6 million times. The exact number isn’t known because the Android Market doesn’t offer precise data,'” according to a report by Dean Takahashi of VentureBeat.”

Advertisement: invisibleSHIELD for Apple iPhone 4

Dilger reports, “The app ‘collects a user’s browsing history, text messages, your phone’s SIM card number, subscriber identification, and even your voice mail password. It sends the data to a web site, http://www.imnet.us. That site is evidently owned by someone in Shenzhen, China,’ the report noted.

“The data theft was only discovered afterward, through forensics performed by mobile security firm named Lookout which sells virus and malware protection software for Android, Windows Mobile and BlackBerry devices,” Dilger reports. “The problem was announced at the Black Hat security conference being held in Las Vegas.”

Full article here.

MacDailyNews Take: Don’t worry, anti-virus leeches and PC fix-it shops, Google will help you transition your based-on-failure business models to the post-Windows world.

Smart people don’t saddle themselves with wannabes, they go with the real thing, from the real innovator. A copier’s work is by nature derivative and behind the curve. Google’s Android = Microsoft’s Windows (without any meaningful sticker price savings).

Please see also: When Closed Is Better Than Open: Apple vs. Google – Joel West, Seeking Alpha, July 29, 2010

[Thanks to MacDailyNews Reader “breeze” for the heads up.]

41 Comments

  1. @: Big Als MBP

    “Ignore the CBC, 95% of Canadians do. 95% of Canadians can’t be wrong

    How can you say that when they still choose to live in Canada, eh? ” width=”19″ height=”19″ alt=”wink” style=”border:0;” />

    BTW, I’m just joking. I love Toronto – one of the great cities of the world, IMO.

  2. I didn’t want to say anything for fear of negative press and retaliation against Apple…but as a direct result of my using an iPhone and apps in Apples app store I lost a couple of close friends.

    Lameness, Disorganization, Confusion, Debt and….did I mention Lameness?

    These were very close friends, and I can hmestly say they will NOT be missed.

    so….suck it Google !

  3. It’s amazing. If you can have most of your phone’s data stolen no one says a word. But if your to lazy to get off your ass to go get a free case that will fix the attena problem the whole world screams apple sucks. MDN magic word: trade. Yeah trade on your droid for a iPhone

  4. ANDROID PHONES: UNSAFE.

    HEY ANDROID USERS:

    Google does NOT test applications that are put into its app store. GOT THAT? Absolutely ANYTHING GOES there. You’ll never know if you’re buying, downloading and installing MALWARE until someone reports it to Google and they then pull the app.

    Oh darn. You’ve been infected and sending off all your personal data, including all your passwords, off to China. Oh darn. No one reported it! Oh darn. MILLIONS of Android users installed this malware. Oh darn. It has taken MONTHS for the malware to be reported to Google.

    This scenario does NOT happen with Apple vetted and approved applications. Every iOS app has been APPLE TESTED and APPROVED. Apple aren’t perfect. But Apple are scrupulous, unlike Google.

    So chew on that Google trolls. I DARE you to swallow it and ask for more.

    ANDROID PHONES: UNSAFE.

  5. ‘Ronin’ points out:
    http://www.appleinsider.com/articles/10/07/29/study_finds_14_of_free_iphone_apps_can_snoop_contacts.html

    The big question is: Do ANY of these ‘snooping’ apps phone home the data? If not, what is Black Hat’s point?

    IF data is being snooped and sent off to nefarious scum, in the case of address contacts, the data can be used to SPAM or send malware. Personal data could be compromised. Clearly this COULD be a problem.

    But IS this a problem on iOS apps? Without any proof of malfeasance, this is merely ‘shouting wolf’. Let’s find out what’s REALLY going on before pointing fingers at what might be going on. A bunch of percentages about harmless application activities are USELESS.

  6. Wireless Test Man pointed out:

    http://www.androidtapp.com/android-wallpaper-apps-falsely-accused-of-spyware-and-stealing-sensitive-user-data-fud/

    My evaluation:

    1) As I posted above, I completely agree with the bogus nature of the so called “App Genome Project.” If the project actually comes up with any meaningful conclusions, as opposed to tenuous FUD, I’ll care.

    2) The accusation of spyware-type activities in wallpaper software by Jackeey Wu remains entirely plausible if only because it was made by the Black Hat community in a formal presentation this past week:

    http://blog.mylookout.com/2010/07/mobile-application-analysis-blackhat/

    To quote Kevin from Lookout:

    “The wallpaper applications that we analyzed transmitted several pieces of sensitive data to a server over an unencrypted network connection.

    THAT’S BAD.

    “Nearly all of the wallpaper applications that we analyzed (more than 80) by “jackeey,wallpaper” and “IceskYsl@1sters!” requested the permission “android.permission.READ_PHONE_STATE” which grants the application access to APIs to access the device’s phone number, subscriber id, and more.

    THAT’S BAD.

    Here is a sample of what was sent, IN THE CLEAR, by Jackeey Wu’s apps:

    sim_serial_number=89014103211118510720
    subscriber_id=310260000000000
    line1_number=15555218135
    voice_mail_number=+15552175049

    THAT’S BAD.

    The Kevin’s CONCLUSION (emphasis mine):

    “While the data this app is accessing is certainly suspicious coming from a wallpaper app, we want to be clear that there is no evidence of malicious behavior. There have been cases in the past where applications are simply a little overzealous in their data gathering practices, but not because of any ill intent.

    IOW: The developer wrote bad apps that unnecessarily asked for, obtained and transmitted IN THE CLEAR sensitive data that could very easily compromise the phone owner. For example, any hacker at Starbucks can pick this data out of the air and use it to compromise the phone owner.

    THAT’S BAD. And it should not ever be allowed to happen on an Android phone. That it IS allowed to happen IS BAD.

    My conclusion: ANDROID PHONES: UNSAFE.

Reader Feedback

This site uses Akismet to reduce spam. Learn how your comment data is processed.