More Malicious Apps Found On Google Play

suraj.sun writes "We've seen quite a few Android malware discoveries in the recent past, mostly on unofficial Android markets. There was a premium-rate SMS Trojan that not only sent costly SMS messages automatically, but also prevented users' carriers from notifying them of the new charges, a massive Android malware campaign that may be responsible for duping as many as 5 million users, and an malware controlled via SMS. Ars Technica is now reporting another Android malware discovery made by McAfee researcher Carlos Castillo, this time on Google's official app market, Google Play, even after Google announced back in early February that it has started scanning Android apps for malware. Two weeks ago, a separate set of researchers found malicious extensions in the Google Chrome Web Store that could gain complete control of users' Facebook profiles. Quoting the article: 'The repeated discoveries of malware hosted on Google servers underscore the darker side of a market that allows anyone to submit apps with few questions asked. Whatever critics may say about Apple's App Store, which is significantly more selective about the titles it hosts, complaints about malware aren't one of them.'"

Re:It drives me crazy

[Anonymous Coward]

There is a "super developer" tag for some developers (adobe, rovio, others), plus there is the "suggested by the team" category, so what you suggest already exists in some form.

Re:Except

[Cute Fuzzy Bunny]

Yep, that was the funny part of the article. "Whatever critics may say about Apple's App Store, which is significantly more selective about the titles it hosts, complaints about malware aren't one of them.'"

But one of them would be that the assertion is ridiculously incorrect.

Even weak google-fu turns up this, among many...
http://nakedsecurity.sophos.com/2011/11/08/apple%E2%80%99s-app-store-security-compromised/ [sophos.com]

Why do apple people think their products and services are malware proof, even though anyone with a self respecting brain capacity would know its not true in theory or in practice? Is that why they pay twice as much for stuff?

Re:Permissions

[alostpacket]

You don't need a permission to read the Android Device ID, however READ_PHONE_STATE gives them access to the ESN, MEID, IMEI, IMSI etc...

The other worrisome problems with that permission are that:

1) It is granted by default for any apps targeting 1.5 or below, and the user is not warned about it.

2) It also allows some access to see incoming and outgoing numbers when a call is taking place.

Re:Happening on App Store too

[chrb]

It's the same problem. From ArsTechnica:

"Google has removed at least 15 Android apps from its official Play market after receiving outside reports they were malicious trojans that siphoned names, telephone numbers of email addresses of every person in the phone's contact list.

..In the background and without warning, they also obtained the phone number and a unique identifier of the infected device and sent the information in clear text to a remote server under the control of the software developers. "

Which is exactly what some iOS apps are also doing. This is not an Android specific problem.

Re:And Apple addressed it

[chrb]

And how is that solution different from Android? Android already requires users to authorize apps to read contact details, the problem is that most people don't care. These Android apps are being called malware because they upload the contacts list without permission, which is exactly the same as many ios apps do.

Re:Except

[BasilBrush]

So the ones that raid your contacts and send the information to persons unknown are fine?

Clearly not. But they are many times less bad than the Android one described that is costing you serious money by sending premium-rate SMSs.

Re:Happening on App Store too

[gstrickler]

5 of those 6 apps listed give you a warning and/or choice before they touch your contacts. Path is the only one that does it without your consent.

I only have one of those 6 installed (FB), and I did not give it permission to access and synchronize my contacts, and I never will.

As others pointed out, comparing that to malware is more than a stretch. You could make a case for Path qualifying because it did so without notification or consent. At most, that's one app that qualifies. Even if you do count it as malware, comparing it to malware that sends SMS messages that cost you money is absurd.

If you want to point out malware on iOS, you should point to the 2-3 actual cases of malware that have been found in the App Store over the years, not 5 applications that notify you they're going to access your contacts.