Google throws 'kill switch' on Android phones

Automatically deletes more than malware-infected apps downloaded by users

For only the second time, Google last weekend remotely deleted Android apps from users' phones.

Google made the move to erase malware-infected applications that users had downloaded from the Android Market, the company's official e-store.

Last Wednesday, Google removed more than 50 infected apps published by three different developers from its marketplace, but didn't trigger automatic uninstalls until several days later.

In many cases, the malicious apps were bogus versions of legitimate programs that had been recompiled to include malware, or as a Symantec researcher said last week, "Trojanized."

According to San Francisco-based smartphone security firm Lookout, between 50,000 and 200,000 copies of the apps were downloaded by users before Google yanked them from the Android Market.

Google has thrown the Android app "kill switch" only once before: In June 2010, it yanked a pair of apps it said were published by a security researcher, who "intentionally misrepresented their purpose in order to encourage user downloads."

In that case, however, the apps were not designed to be used maliciously, and did not request permission to access private data.

According to Lookout, which has been analyzing the infected apps since last week, the recently-pulled-and-uninstalled apps not only demanded extended permissions, but also made off with a wide range of information from the infected phones. Among the data pulled by the infected apps: the phone's IMSI (International Mobile Subscriber Identity) and IMEI (International Mobile Equipment Identity) numbers, unique identifiers of the subscriber and smartphone.

After one of the infected apps is downloaded and installed, the phone also surreptitiously downloads a second-stage with "one or two root exploits," said Kevin Mahaffey, the CTO of Lookout, that give attackers complete control of the device.

"I don't know if the hackers were joking when they named [the malware] DroidDream, but the second-stage only downloads between 11 p.m. and 8 a.m., when most users are asleep," said Mahaffey. He speculated that the timing was to insure users didn't notice any unexplained network activity while that stage was downloaded.

Besides pulling the kill switch, Google is also pushing an app of its own, dubbed "Android Market Security Tool March 2011," to all affected Android phones, said Rich Cannings, the head of Android's security team, in a blog post Sunday.

That app, which will be installed automatically no later than Tuesday on all Android phones whose owners had downloaded one or more of the malicious apps, prevents attackers from accessing any additional information by undoing the root access the malware obtained by exploiting vulnerabilities.

The Android Market Security Tool March 2011 does not patch the underlying bugs that were exploited by the malware-infected apps, said Mahaffey, but does appear to remove traces of the malicious code that aren't erased when the apps are uninstalled. Lookout is continuing to dig into Google's tool for more insight into its workings.

According to Google, Android 2.2.2 and earlier contains the bug, but later versions, including Android 2.3, aka "Gingerbread," do not.

Unlike Apple, Google does not distribute its own mobile operating system updates, whether security-related or otherwise, but relies on carriers to do so. Google launched Android 2.3 in December 2010, but as of mid-February, the bulk of Android phones -- nearly 90 per cent by Google's numbers -- were still running older, and thus vulnerable, versions of the operating system because carriers often take months to roll out Android updates.

Analysts have also blamed Google's lax app publishing policy for allowing the infected software onto the Android Marketplace.

"Google will change its model," said John Pescatore, a security analyst with Gartner Research, referring to Google's current practice of not vetting the apps listed in the market. In contrast, Apple closely reviews all apps that it places in its App Store, which is also the only sanctioned outlet for the iPhone.

"Google's search engine tells users when it suspects a site might be distributing malware," Pescatore noted. "That's what the market wants in a search engine and in mobile. People don't want to say, 'Oh oh, should I download this app?' They just want to say, 'That's a cool app, I'll download it.'"

Pescatore also knocked Google for resorting to pushing the security tool to users after the fact. "That's the worst of both worlds, if Google says 'We'll continue to let anything in the Market, but then says, 'Download this [anti-malware] app,'" said Pescatore. "Don't force us back to the bad ways of the PC.

"It's so much better to keep the bad stuff off in the first place," Pescatore said. "Come on, Google."

Mahaffey, however, applauded Google's decision to automatically install the tool. "Hats off to Google," he said today.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed. His e-mail address is gkeizer@computerworld.com.

Read more about security in Computerworld's Security Topic Center.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags Mobile Apps and ServicesapplicationstelecommunicationPhonesMobile operating systemsMalware and VulnerabilitiesmobileGooglesymantecconsumer electronicssecurityMobile OSessmartphonessoftware

Struggling for Christmas presents this year? Check out our Christmas Gift Guide for some top tech suggestions and more.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?