“Google has come under fire in recent months for letting a few dozen nasty apps into its Android market, bent on stealing data or siphoning money with paid texts,” Andy Greenberg reports for Forbes. “But one new exploitative app doesn’t need to be let in to Google’s App store. It creates a fake Market of its own.”
MacDailyNews Take: “Open.”
“The malware, labeled GGTracker by the researchers for security firm Lookout Mobile Security who first revealed the new malware in a blog post Monday night, is spread through in-app advertisements, Lookout believes,” Greenberg reports. “When a user clicks those ads, which promote programs with names like Sexy Pics or Battery Saver, he or she is taken to a website that’s designed to look like the Android Market, but in fact downloads the app without any interaction. Then the user is directed to the downloads folder to install the app, which then silently sends text messages to a pay-per-text number, racking up charges at the victim’s expense.”
MacDailyNews Take: Wiiide “open.”
Read more in the full article here.
MacDailyNews Take: Google’s ill-conceived, wannabe iOS rush-job strikes again. Lesson: Get the real thing. Don’t settle for inferior, insecure knockoffs.
[Thanks to MacDailyNews Readers “Fred Mertz” and “Dale S.” for the heads up.]
Related articles:
Google forced to pull several malware-infested apps from Android market – June 8, 2011
Android malware sees explosive growth; even faster than with PCs – April 27, 2011
Virus-laden apps infest Google’s ‘open’ Android platform; iPhone unaffected – March 3, 2011
Security firm warns of new Android trojan that can steal personal information; iPhone unaffected – December 30, 2010
Trojan infects Android smartphones; iPhone unaffected – August 10, 2010
Millions of Android phone users slammed by malicious data theft app – July 29, 2010
Unlike proactive Apple, reactive Google doesn’t block malware from Android app store – June 4, 2010
Malware designed to steal bank information pops up in Google’s Android app store – January 11, 2010
Google becomes more synonymous with Microsoft every day…and that’s not a good thing!
Make things that “Just Work” or die.
I think there should be some kind of basic approval process, at the minimum they should be scanning for various activities an app might do that are malicious and then flag the app for further investigation before approving it into the market.
On the flip side I search for this stuff every time I see one of these articles and cannot even find a single one, which is strange because I happen to be damn good at tracking things like this down, its part of what I do (just not on Android for a living, but Winblows).
Seems more sensationalized to me than anything else at this point. Kind of like the big malware scare on OS X recently.
The end is nigh… drink the koolaid!
Once Google succumbed to an approval process for the Android Market, it would go against the grain of its “open” mantra. It would have to eat crow and admit that Apple’s policy is the right one. Now Google’s misstep is coming back to bite Google in its butt.
Yup and i think that day will come soon.
Hey Google, how’s the Crow tasting?
I don’t think so. They don’t need to go to the lengths Apple has gone and become the ‘moral police’ of the market.
They require you to meet some basic API standards with your application in order to even run it, security should be a part of that.
Whatever length Google goes into implementing its approval process, it’s a slap in the face. Wasn’t Google lied to the whole world that it is the father of “open”?
“[Google] don’t need to go to the lengths Apple has gone and become the ‘moral police’ of the market.”
That’s Google’s choice. But it is OBVIOUS that Google has invest in vetting EVERYTHING entering the Android app market in order to cull out the malware. Otherwise I only hear a rising and deafening din of laughter at Android security. 😆
Seems more sensationalized to me than anything else at this point. Kind of like the big malware scare on OS X recently.
The difference there is, Apple has the power to do something about it. Google, not so much.
I think there should be some kind of basic approval process, at the minimum they should be scanning for various activities an app might do that are malicious and then flag the app for further investigation before approving it into the market.
I’m assuming you missed the part of the article that says “one new exploitative app doesn’t need to be let in to Google’s App store [sic]. It creates a fake Market of its own.” Not much Google can do to to investigate or deny apps that aren’t in their Market.
So does Google, they can nuke the stuff if its in the market and remove it from handsets. They have done this before.
I saw the part about side-loading but here is my issue with that, by default Android won’t install software from ‘unknown sources’. Everything has to be digitally signed by Google and in the marketplace. Basically you have to go into your phone and explicitly set it to allow “unknown sources” otherwise the .APK file will fail to load.
So the only people at risk if its not in the market are people who explicitly changed the security setting of their device to allow it to install any application.
Usually you see developers or people with rooted devices who install from non-standard places do this, the everyday user is not going to be aware of making the change in the settings.
Still you don’t get it and want to justify Google’s action. Google is against all forms of curation. However minimal Google goes about security it is sincerest form of flattery to Apple’s foresight of ensuring freedom to its users while Google’s users are steeped in a climate of fear and insecurity. A paradox you may not want to admit.
No i get it read what i wrote again.
LOL DUDE GET OFF THE DRUGS. There is no freedom of any kind on the iphone. Its an illusion unless you want to jailbreak.
Adding an approval process wouldn’t help in this situation. The only thing that would help is disabling the side-loading of applications, coupled with an approval process. This particular piece of malware is side-loaded.
At the very least there have to be marketplaces for Android apps that are certified as ‘vetted’ to keep out malware. Google are the ones to do the vetting as it is their OS. There does not have to be only one Android app market à la Apple. But there does have to be one and only one universal vetting process. It’s gotta happen.
Google should have seen this coming. Gigantic DUH Factor. Cleaning out the malware after-the-fact, only to allow it back into the market again via meagre code changes, is ridiculous at this point in computer security history. This is ALL preventable.
Apple’s “walled garden” looks more lush, safe and inviting every day…
“anDroid Does”
I honestly look forward to the day that Google is scrambling to save their mobile advertising efforts and regrets their bad decision to screw Apple instead of align with them
Every time some spammer goes to great lengths to place an unwanted ad in front of my eyes I wonder how it is that they think annoying me is going to get me to buy something. A business built on that model is not one I want to invest in, so no, I will never own a share of Google. Think about it.
Like I said, you would have to be an idiot to deploy Android for business!
It’s just a matter of time before Larry Page and Sergey Brin pull the plug on Android. They demoted Schmidt cause he made Steve Jobs angry and the Android Experiment is not helping Google’s bottom line or the OEM’s that employ it. Google is NOT a consumer company and can only pretend it is by giving away products for free. However, maintaining a fully “open” Operating System is too big a task even for Google.
I suspect this is being done by iPhone-supremacists.
I suspect you’re trolling.
“Google has come under fire in recent months for letting a few dozen nasty apps into its Android market”
GET REAL!
The count so far is OVER 100 Android Trojans. And because of the nature of the ‘open’ Android app system, there is nothing preventing the recycling of these same old Trojans under new names and marketing jargon. In short: The Android app market has become a cesspool of malware and that’s NOT going to change if Google doesn’t change its attitude.
No such problem with the Apple iOS app market. I like it.
[I write about Mac security at Mac-Security Blog]
That green little Android has a little red area in his groin.