After attacks, Google vows to fortify Android Market

The company was forced to use a remote kill feature to sanitize Android phones of malware

Google will build new safeguards into Android Market, its application store for the Android mobile OS, following an attack that infected thousands of phones and forced the company to wipe the malware remotely from phones, it said late Saturday.

More than 50 applications in the Android Market were found to contain a program called DroidDream, which is capable of stealing information about a mobile device and, more dangerously, downloading other malicious applications to the phone.

Google was fairly silent about the problem until Saturday, when it confirmed in a blog post that it decided to use a command that remotely erases malicious applications.

Android users that have downloaded a malicious application will get an e-mail within three days from the address android-market-support@google.com explaining the situation, wrote Rich Cannings , Android's Security Lead. In addition to wiping malware, Google is also forcing an update on users called "Android Market Security Tool March 2011" which fixes the security issues that DroidDream exploits.

Some users may get a notification on their device that a malicious application has been removed, Cannings wrote. About a day after the vulnerabilities have been fixed, users will receive a second e-mail.

Phones running Android versions below 2.2.2 are vulnerable. The issues are fixed in the latest 2.3 version of Android, known as "Gingerbread."

DroidDream uses two exploits called "exploid" and "rageagainstthecage" to get installed on the phone, according to Lookout Mobile Security, a company that has analyzed DroidDream. The company was tipped off to the situation last week by a Reddit user going by the name of Lompolo.

Lookout posted a deeper analysis of DroidDream on its blog on Sunday, revealing more alarming details of the application. DroidDream is coded to only operate from 11 p.m. to 8 a.m., "a time when the owner of an infected device would most likely be sleeping and not notice any strange behaviors on the phone."

DroidDream gains root access to Android's Linux operating system. Google wrote that it appeared to gather a device's International Mobile Equipment Identity (IMEI) number and the SIM card's International Mobile Subscriber Identity (IMSI) number.

That information was sent to a remote service located in Fremont, California, according to Lookout.

After sending the information, DroidDream downloads a system application called "DownloadProviderManager.apk," which prevents someone from either seeing it or uninstalling it without other special permissions, according to Lookout.

That second stage application then collects additional information, including product identification, phone model, language used on the phone, country information and userIDs, Lookout wrote. It can also silently download other applications.

"The first phase of the malware served to gain root access on the device while the second phase predominantly serves to maintain a connection to the command-and-control server to download and install other files," Lookout wrote. "Because we have not seen the command-and-control server issue commands to download additional applications we cannot divine their exact purpose. However the possibilities are limitless."

"DroidDream could be considered a powerful zombie agent that can install any applications silently and execute code with root privileges at will," Lookout wrote.

Google has taken the affected applications, many of which were legitimate applications that had been modified with DroidDream, out of the Android market. It banned the publishers of the tainted applications and contacted law enforcement, it said.

The DroidDream incident marks the first wide-scale infestation of Google's official Android Market with malware, although there have been prior instances of tampered applications.

Google does little vetting of the Android Market, saying it wants developers to be able to quickly get applications in the hands of users. Nonetheless, "security is a priority for the Android team, and we're committed to building new safeguards to help prevent these kinds of attacks from happening in the future," Cannings wrote.

Send news tips and comments to jeremy_kirk@idg.com

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malwaremobile securityGoogleAndroidPhonesconsumer electronicsExploits / vulnerabilities

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

Bang and Olufsen Beosound Stage - Dolby Atmos Soundbar

Learn more >

Toys for Boys

Nakamichi Delta 100 3-Way Hi Fi Speaker System

Learn more >

Sony WF-1000XM3 Wireless Noise Cancelling Headphones

Learn more >

ASUS ROG, ACRONYM partner for Special Edition Zephyrus G14

Learn more >

Family Friendly

Philips Sonicare Diamond Clean 9000 Toothbrush

Learn more >

Mario Kart Live: Home Circuit for Nintendo Switch

Learn more >

Stocking Stuffer

Teac 7 inch Swivel Screen Portable DVD Player

Learn more >

SunnyBunny Snowflakes 20 LED Solar Powered Fairy String

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?