Trojan Apps Hijack Android App Store

Google removes 20+ Apps from Android Market, signaling that malware distribution has gone mainstream, and not just for Droids.

The Adroid Operating System is open source – meaning that anyone can create applications without Google’s approval. It boosts innovation, and unlike Apple iPhones or Blackberrys, Droid Apps aren’t bound by all of the rules surrounding the Apple App Store. But this leniency can be exploited by hackers, advertisers and malicious apps. And now those apps aren’t just available on some sketchy off-market website, but on the Android Market itself. As smartphones and tablets become one of the primary ways we conduct business, including banking, this development shifts the security conversation into high gear.

A recent discovery forced Google to pull 21 popular and free apps from the Android Market. According to the company, the apps are malware and focused on getting root access to the user’s device (giving them more control over your phone than even you have). Kevin Mahaffey, the CTO of Lookout, a maker of security tools for mobile devices, explained the Android malware discovery in a recent PC World article (emphasis mine):

“DroidDream is packaged inside of seemingly legitimate applications posted to the Android Market in order to trick users into downloading it… Unlike previous instances of malware in the wild… DroidDream was available in the official Android Market, indicating a growing need for mainstream consumers to be aware of the apps they download and to actively protect their smartphones.”

An example of a Trojan App, as I like to call it (because it hides an attack beneath a harmless – or even attractive – exterior), is a Droid app simply called “Chess.” The user downloads it assuming that it will allow them to play chess on their phone. Once downloaded, however, the app assumes root control of the device, transmits highly sensitive user data back to the author and leave a ‘Back Door’ open to allow further malicious code to be added to the phone at any time. Disguising malicious apps as legitimate and popular software is what makes this game so easy and profitable for hackers. That the apps are then available on a well known app site (run by Google), gives them an air of legitimacy.

Here are several tips from The Smartphone Survival Guide to help you begin protecting your mobile phone, whether it is a Droid, iPhone, BlackBerry or Windows Phone:

Be wary of free apps – almost all of them, legitimate and otherwise – are siphoning your information to the developers.
Before you download an app, perform a bit of due diligence, including but not limited to:
If it hasn’t been out for long enough to have been tested, don’t download it (let the marketplace approve it first)
Research the publisher of the App to see if they have a clean track record.
Perform a Google search for reputable reviews on the app (Macworld, PC Magazine, PC World, Wall Street Journal).
Don’t automatically believe the reviews on established App Stores (Apple, Android, BlackBerry, Windows) as they are often written by the developer (or malware author).
Realize that legitimate, fully vetted apps like Pandora are siphoning your information too, though in a more benign way.
Always check your app permission settings (if available) to see what information they are forwarding back to the creator of the app.
Install security software on your phone (if available).

Remember, all apps are not malicious, just a small fraction are bad apples. And Android isn’t the only source of this problem, it’s simply the most open of the App platforms and therefore more susceptible. Apple has pretty Draconian rules for getting apps approved, which has helped minimize exposure on iPhones. But if you aren’t taking steps to educate yourself about this latest and greatest fraud source, you’re going to get stung.

John Sileo is the award-winning author of the Smartphone Survival Guide: 10 Critical Security Tips in 10 Minutes and four other books. He speaks professionally on playing information offense to avoid identity theft, social media exposure, cyber fraud, data breach and reputation manipulation. His clients include the Department of Defense, Pfizer and Homeland Security. Learn more at www.ThinkLikeASpy.com.

Posted by Identity Theft Speaker John Sileo in Cyber Data Security, Identity Theft Prevention and tagged Android, Android Market, App Store, Applications, Apps, BlackBerry, BlackBerry Security, data security, Droid, Droid Security, Expert, Fraud, Hacking, Hijacking, iPhone, iPhone Security, jail break, jail breaking, Jailbreaking, John Sileo, Lookout, Mobile Phone, safety, Security, Smart Phone, Smartphone, Smartphone Survival Guide.