Google in Android Market malware purge

Google has removed dozens of apps from its Android Market after discovering they were malware that compromised users' personal data.

More than 50 apps were found to be infected with malware capable of gaining root access to a device, harvesting data and installing additional malicious code, computer security researchers said Wednesday. Before being pulled from the marketplace, the malicious apps were downloaded by at least 50,000 Android users within a four-day period.

A Google spokesman declined to comment.

The malicious apps were pirated versions of popular, legitimate apps that cybercriminals bundled with malware and republished in the Android Market under different application and publisher names. They were posed by the publishers with handles “Kingmall2010,” “we20090202,” and “Myournet,” all of whom have been suspended.

The first batch of 21 malicious apps, which came from the publisher Myournet, was discovered by a user of the news aggregation site Reddit. Researchers at mobile security provider Lookout discovered a second lot that was posted by Kingmall2010 and alerted Google, said its chief technology officer Kevin Mahaffey.

Google then discovered a third set that was posted by we20090202.

It removed the malicious apps within minutes of being notified, Mahaffey said.

“It's impressive how quickly they responded to these issues,” he said.

Even though the apps were posted from different developer accounts, the way the malware was packaged indicated they came from the same person, Mahaffey said.

Flip to the next page to peer inside the workings of the Android malware.