Google Strengthening Android Store After Attacks
Google will build new safeguards into Android Market, its application store for the Android mobile OS, following an attack last week that infected thousands of phones and forced the company to wipe the malware remotely from phones, it said late Saturday.
Over 50 applications in the Android Market contained a program called DroidDream, which is able to steal information about a mobile device and, more dangerously, download other malicious applications to the phone.
Google was fairly quiet about the problem until Saturday, when it confirmed in a blog post that it chose to use a command that remotely erases malicious applications.
Android users that have downloaded a malicious application will get an e-mail within three days from email@example.com explaining the situation, wrote Rich Cannings , Android's Security Lead. As well as wiping malware, Google is also forcing an update on users called "Android Market Security Tool March 2011" which resolves the security issues that DroidDream exploits.
Some users may get a notification on their device that a malicious application has been deletedd, Cannings wrote. About a day after the vulnerabilities have been fixed, users will receive a second e-mail.
Phones running Android versions below 2.2.2 are susceptible. The issues are fixed in the latest 2.3 version of Android, known as "Gingerbread."
DroidDream uses two exploits called "exploid" and "rageagainstthecage" to get installed on the phone, according to Lookout Mobile Security, a company that has analyzed DroidDream. The company was tipped off to the situation last week by a Reddit user going by the name of Lompolo.
Lookout posted a deeper analysis of DroidDream on its blog on Sunday, outlining more alarming details of the application. DroidDream is coded to only operate from 11 p.m. to 8 a.m., "a time when the owner of an infected device would most likely be sleeping and not notice any strange behaviors on the phone."
DroidDream gains root access to Android's Linux operating system. Google wrote that it appeared to gather a device's IMEI and IMSI number and send that information to a remote service located in California.
After sending the information, DroidDream downloads a system application called "DownloadProviderManager.apk," which stops someone from either noticing it or uninstalling it without other special permissions, according to Lookout.
That second stage application then collects more information, including product identification, phone model, language used on the phone, country information and userIDs, Lookout wrote. It can also silently download other applications.
"The first phase of the malware served to gain root access on the device while the second phase predominantly serves to maintain a connection to the command-and-control server to download and install other files," Lookout wrote. "Because we have not seen the command-and-control server issue commands to download additional applications we cannot divine their exact purpose. However the possibilities are limitless."
"DroidDream could be considered a powerful zombie agent that can install any applications silently and execute code with root privileges at will," Lookout wrote.
Google has taken the affected applications, many of which were legitimate applications modified with DroidDream, out of the Android market. It banned the publishers of the tainted applications and contacted law enforcement, it said.
The DroidDream incident marks the first wide-scale infestation of Google's official Android Market with malware, although there have been prior occurence's of tampered applications.
Google does little vetting of the Android Market, saying it wants developers to be able to get applications into the hands of users quickly. Nonetheless, "security is a priority for the Android team, and we're committed to building new safeguards to help prevent these kinds of attacks from happening in the future," Cannings wrote.
Return to security news headlines
View Security News Archive