Android Trojan Found, Spreading From Chinese App Stores

wiredmikey writes that researchers from Lookout Mobile have discovered a sophisticated Trojan targeting Android devices. "The company says the mobile malware is 'The most sophisticated Android malware we've seen to date. Geinimi is also the first Android malware in the wild that displays botnet-like capabilities. Once the malware is installed on a user's phone, it has the potential to receive commands from a remote server that allow the owner of that server to control the phone.' What makes the Trojan different from most 'standard' mobile malware is that Geinimi is being 'grafted' onto repackaged versions of legitimate applications, primarily games, and distributed in third-party Chinese Android app markets."

I guess RTFA went out the window entirely...

[AltairDusk]

Here's the story on the Lookout Blog. [mylookout.com]

Not "malware"

[Anonymous Coward]

Lookout Mobile appears to be in the process of trying to redefine "malware" to mean "software that sends more data about a phone to a remote server than Lookout think it should". This is not the standard definition of malware that we all know and love.

This Android "trojan" is not like regular viruses from the PC world in many ways. It cannot resist uninstallation. It cannot infect other applications. It cannot lie about what it will do - the permission screen states quite clearly what the apps in question have access to. It cannot steal your passwords or bank details.

There are legitimate questions to ask about apps that send phone IDs surreptitiously to some remote people, but calling these apps "trojans" or "malware" is dangerous, it makes people think they need a virus scanner for their phone when in reality they don't. That's exactly what "Lookout" want of course but it's no reason to believe them.

Re:A lot like Windows after all

[MrHanky]

Yeah, except this is not a virus and Android doesn't seem to be very susceptible to viruses.

Re:A lot like Windows after all

[0123456]

Whenever anything bad happens on the android platform related to malware, trojans, etc this distinction is heavily downplayed.

Again, if I download and install malware on one of my Linux boxes, how is this a Linux problem?

Linux protects much better than Windows against remote attacks, it can't protect against stupid users.

Re:Not "malware"

[Riceballsan]

I believe the point is, it does have to get explicit permission when it is installed, the android prompts you when installing it asking Do you want to give this application access to Storage, Contact list, GPS cordinates, Internet access etc etc...
It is like a robber that has to knock on your door and ask you to give him your wallet, keys and laptop.