First malware found in wild that exploits Android app signing flaw

“Just three weeks after Bluebox Security first announced the discovery of a key flaw in Google’s Android with the potential to turn devices into a ‘zombie botnet,’ Symantec has reported finding rogue apps that take advantage of the vulnerability,” Daniel Eran Dilger reports for AppleInsider.

“At the beginning of July, Bluebox went public with news of the flaw, which affected virtually every Android device in use,” Dilger reports. “Google ‘declined to comment on the matter,’ but quickly acted to block distribution of apps seeking to exploit the issue in its own Google Play market. However, one of the primary key features of Android is the ‘openness’ to allow users to install software from other stores.”

Dilger reports, “That freedom has now morphed into a liability. While researchers quickly released ‘test tube’ apps demonstrating how the vulnerability can be exploited, Symantec has now identified the first malware in the wild that’s seeking to take advantage of the flaw, and Google’s extreme difficulty in patching millions of vulnerable devices. ”

Read more in the full article here.

MacDailyNews Take: If Google were to be honest, Android’s next codename should to be “Cesspool.”

Related articles:
Mobile Threats Report: Android accounts for 92% of all mobile malware – June 26, 2013
Latest self-replicating Android Trojan looks and acts just like Windows malware – June 7, 2013
99.9% of new mobile malware targets Android phones – May 30, 2013
Mobile malware exploding, but only for Android – May 14, 2013
Mobile malware: Android is a bad apple – April 15, 2013
F-Secure: Android accounted for 96% of all mobile malware in Q4 2012 – March 7, 2013
New malware attacks Android phones, Windows PCs to eavesdrop, steal data; iPhone, Mac users unaffected – February 4, 2013
FBI issues warning over Android malware attacks – October 15, 2012
Researchers discover serious flaw in Android app security, say HTC and Samsung ignore issue – September 28, 2012
Apple’s iPhone has passed a key security threshold – August 13, 2012
Android permissions flaw allows eavesdropping, data theft, location tracking – December 2, 2011
Massive HTC Android security flaw leaves security expert speechless – October 2, 2011
Apple’s iOS unaffected by malware as Android exploits surge 76% – August 24, 2011
Android malware records phone calls; iPhone users unaffected – August 2, 2011
Symantec: Apple iOS offers ‘full protection,’ Google Android ‘little protection’ vs. malware attacks – June 29, 2011
Malware apps spoof Android Market to infect Android phones – June 21, 2011
Google forced to pull several malware-infested apps from Android market – June 8, 2011
Android malware sees explosive growth; even faster than with PCs – April 27, 2011
Virus-laden apps infest Google’s ‘open’ Android platform; iPhone unaffected – March 3, 2011
Security firm warns of new Android trojan that can steal personal information; iPhone unaffected – December 30, 2010
Trojan infects Android smartphones; iPhone unaffected – August 10, 2010
Millions of Android phone users slammed by malicious data theft app – July 29, 2010
Unlike proactive Apple, reactive Google doesn’t block malware from Android app store – June 4, 2010
Malware designed to steal bank information pops up in Google’s Android app store – January 11, 2010


  1. Read the full article. It’s a real eye-opener.

    Makes Android seem pretty scary. Maybe it has something to do with all those emails I have been getting lately that seem to come from friends of mine (many of whom haven’t written to me in years) saying, “Hey, Dennis, check this out…” with a link to click on and nothing more.

  2. The scary thing is that US Gov (and other Gov) continue to incorporate Android into defense, intelligence, and other critical sectors of the Gov.

    Android – “Open” for the wrong reasons. Using Android is like having sex with Las Vegas “working” girls without the condom.

    my 2 cents…

Reader Feedback

This site uses Akismet to reduce spam. Learn how your comment data is processed.