Skip Links

Google throws 'kill switch' on Android phones

Automatically deletes more than malware-infected apps downloaded by users

By Gregg Keizer, Computerworld
March 07, 2011 02:48 PM ET

Computerworld - For only the second time, Google last weekend remotely deleted Android apps from users' phones.

Google made the move to erase malware-infected applications that users had downloaded from the Android Market, the company's official e-store.

Last Wednesday, Google removed more than 50 infected apps published by three different developers from its marketplace, but didn't trigger automatic uninstalls until several days later.

ANALYSIS: Google Android's infected apps spotlight mobile danger

In many cases, the malicious apps were bogus versions of legitimate programs that had been recompiled to include malware, or as a Symantec researcher said last week, "Trojanized."

According to San Francisco-based smartphone security firm Lookout, between 50,000 and 200,000 copies of the apps were downloaded by users before Google yanked them from the Android Market.

Google has thrown the Android app "kill switch" only once before: In June 2010, it yanked a pair of apps it said were published by a security researcher, who "intentionally misrepresented their purpose in order to encourage user downloads."

In that case, however, the apps were not designed to be used maliciously, and did not request permission to access private data.

According to Lookout, which has been analyzing the infected apps since last week, the recently pulled-and-uninstalled apps not only demanded extended permissions, but also made off with a wide range of information from the infected phones. Among the data pulled by the infected apps: the phone's IMSI (International Mobile Subscriber Identity) and IMEI (International Mobile Equipment Identity) numbers, unique identifiers of the subscriber and smartphone.

After one of the infected apps is downloaded and installed, the phone also surreptitiously downloads a second-stage with "one or two root exploits," said Kevin Mahaffey, the CTO of Lookout, that give attackers complete control of the device.

"I don't know if the hackers were joking when they named [the malware] DroidDream, but the second-stage only downloads between 11 p.m. and 8 a.m., when most users are asleep," said Mahaffey. He speculated that the timing was to insure users didn't notice any unexplained network activity while that stage was downloaded.

Besides pulling the kill switch, Google is also pushing an app of its own, dubbed "Android Market Security Tool March 2011," to all affected Android phones, said Rich Cannings, the head of Android's security team, in a blog post Sunday.

That app, which will be installed automatically no later than Tuesday on all Android phones whose owners had downloaded one or more of the malicious apps, prevents attackers from accessing any additional information by undoing the root access the malware obtained by exploiting vulnerabilities.

The Android Market Security Tool March 2011 does not patch the underlying bugs that were exploited by the malware-infected apps, said Mahaffey, but does appear to remove traces of the malicious code that aren't erased when the apps are uninstalled. Lookout is continuing to dig into Google's tool for more insight into its workings.

Originally published on www.computerworld.com. Click here to read the original story.

Our Commenting Policies
Latest News
rssRss Feed
View more Latest News