Google in Android Market malware purge

Inside the Android malware

Once downloaded, the apps attempted to gain root access to a device using common exploit tools, such as “rageagainstthecage” or “exploid”.

They were often used by hobbyists to jailbreak or access the root account on their Android phones, Mahaffey said.

The apps then attempted to send data from the phone to a remotely controlled server. Specifically, they tried to steal IMEI and IMSI numbers, used to identify mobile phones, model numbers and the user's language, ID and country.

Most alarmingly, the apps attempted to open a backdoor to the devices that could be used to download additional malware, researchers said.

The apps gave attackers “full access” to a device, said Vikram Thakur, Symantec principal security response manager.

Cybercriminals regularly package malware inside seemingly legitimate apps and release them in unofficial, third-party app stores, researchers said. This time the malicious apps made their way on to the official Android Market, which provided a much larger pool of potential victims.  

Veracode chief technology officer Chris Wysopalsaid similar attacks were likely unless Google more stringently policed the apps it allowed.

Google relied on users to flag apps as harmful or inappropriate. If an app violated Google's policies, it was removed from the market and the developer may be blocked.

Other mobile app store providers took a different approach. Microsoft, for example, mandated that apps and games in its Windows Phone Marketplace were tested and certified for quality and performance before being offered to consumers.

Wysopal said Google should adopt a similar model: “I believe the app stores should be vetting the apps with an approval process before allowing them in”.

But Lookout's Mahaffey said Google's process allowed for an “open, innovative app ecosystem” and should not be changed.

Malicious apps disguised as legitimate programs began turning up the Android Market a year ago.

This article originally appeared at scmagazineus.com