Blog Post

Who Mobile Malware Affects, and How

After years of being overhyped by vendors of security software, mobile malware is finally a real threat. Google banished more than four dozen free apps from its storefront last week after it was discovered that the titles contained a Trojan horse designed to steal users’ information. The apps, which included pirated and copycat versions of legitimate Android (s goog) titles, had been downloaded tens of thousands of times before being identified and ousted. Which demonstrates why Google’s anything-goes policy regarding Android Market is becoming so dangerous.

DroidDream, as the virus was dubbed, may have been the most damaging piece of malware yet to affect mobile users, but the vulnerabilities of Android Market have long been a cause for concern. And Google’s refusal to play app cop could impact the mobile application space and its players:

  • Competing app stores: Competing app stores like Amazon’s (s amzn) upcoming storefront have a chance to differentiate their wares by vetting them before making them available to consumers.
  • Developers: User reviews are fine, but the app world needs to come up with a universal system for testing apps and making them easy for consumers to identify.
  • Security vendors: Established players like McAfee (s mfe) and Kaspersky Lab would be wise to leverage their reputation on PCs as they try to exploit the mobile space, while smaller vendors will need to find ways to market their software through tactics like in-app advertising and freemium offerings.

The bottom line is that Google’s unwillingness to play app cop could damage the reputation of Android Market — and maybe even the operating system as a whole. For more thoughts on how those dangers could impact the world of mobile applications, please see my column this week at GigaOM Pro (subscription required).

Image source: Flickr user chego101.

Related content from GigaOM Pro (subscription required):

14 Responses to “Who Mobile Malware Affects, and How”

  1. Ondrej

    I’d say the fundamental question is why should the OS vendors operate the app stores in the first place! Does Microsoft or Apple vet every piece of software for Windows or MacOS? No, and that’s probably what Google thinks. But in that case, it shouldn’t be operating a store. I expect supermarket to sell me food safe for consumption. It is when I take my rifle and go to hunt, when I do so with the expectation that nobody guarantees me anything.

    • Whats wrong with installing anti virus and the like. We should all do it with pc’s & even macs now, and mobiles are no different. When I got
      my new droid phone anti virus was the first app I installed. If u leave ur security to others, u will be dissapointed. Think about the future. Swapping data from phone 2 phone could be a chance to infect. Protect ur self and then there is no need to complain.

  2. I feel like i’ve just read an ad for the gigaom pro article. Even worse, it reads like such a superficial analysis that it could easily be accused of propaganda.

  3. ProLaqq

    This is popular misconception by people that don’t really understand technology or security. iOS app store is no “safer” than Android’s, just because software is tested for stability in iOS doesnt mean it is protected against malware. There have already been many credible apps that have hidden functionality made public (remember the camera button?) to prove how easy it is to get around the rules. iOS app source code is not reviewed & apps are generally approved in a matter of minutes. In fact, many people would argue that iOS is more dangerous because it allows lower level programming.

    The only reason Android will someday become more likely to have malware than iOS & others is because of it’s overwhelming popularity & skyrocketing marketshare. Most malware dev’s wont target small niche markets that iOS, HP, MS are going to share.

    • samantha

      I agree with you. The Apple process has allowed so many apps with hidden functionality through that it’s fairly obvious they are not examining them closely enough to provide any kind of security. Didn’t some 14 year old kid get a tethering app disguised as a screensaver onto the app store? Even a cursory examination of the source would have revealed something wasn’t right with that software, and yet Apple approved it.

      Another point that seems to be often missed by tech writers is that most people just don’t care about this kind of thing. Windows has a much larger problem with malware than Macs do, yet Windows outsells Mac by 10 to 1 year after year.

    • You guys carry on telling yourselves that, the number of Android and iOS devices out in the wild is not dissimilar and the same Mac vs Windows argument (which I think is no longer valid) does not work here. We are not talking orders of magnitude difference in sales.

      My understanding is that virtually evert iOS device has an associated iTunes account with a card or bank details attached. That makes it a HUGE, potentially lucrative target.

      I’m getting really concerned now to the point where I am wondering exactly what I have bought into here. The Android codebase is firing off in so many directions at once and Google clearly have no interest in protecting users that I am now thinking this great concept of ‘Openness’ that was sold to me is a bunch of crap. I was warned that they are only interested in pushing adverts to people and making money from that and I am beginning to feel foolish now.

      If I have to install Antivirus or other protective software on my phone that’s it, I’m outta here. Not going through the same crap I have for years with Windows when this could have been avoided by design.

      • acupunc

        Many of your points are certainly valid. The malware on Android is a little over blown right now IMO.

        The reason I say that is, if a user uses a little common sense they would never have a problem–download from good sites only, make sure the app you are downloading is not new, it should have a few reviews, don’t be the first adopter of an app, etc. . These simple things will keep you safe ;)

        The Android community is great and very active and bad apps get reported very quickly, thus it would be very uncommon for a virus infected app to be in the market for a week+.

        As for Google. . . I would argue that they have done a lot to reduce your chances of running into malware on the web–more so than any other company. However, you would need to use their products, at least search. They do need to do more in the Android Market and today they released statements that they plan to do more. What that “more” is has yet to be stated clearly.

        Windows. . . I’ve never used any anti-virus utilities on my windows computers (since ’97) and I’ve never had one single issue. The reason for that is, I know how to setup windows to be safe. The sad thing is, manufacturers send Windows computers out setup for easy infection–that’s on MS & the manufacture as they both should do better.

    • Colin Gibbs

      I don’t write code, ProLaqq, but I’ve covered this stuff for the better part of a decade so I know a bit. And as you and Samantha point out, Apple’s policies don’t guarantee that every app will be malware-free. But most of the DroidDream-tainted were repackaged versions of legitimate apps, and behavior-based antivirus scanning could go a long way in rooting out much the nasty stuff in Android Market.

  4. There’s been a good amount of discussion on this topic on Android sites and generally people seem to feel that Google needs to step up and monitor the influx of apps better–scan for malware and check for pirated apps, etc. Google seems to have listened a bit and did some cleaning up but they need to be more proactive instead of reactive.

    As Amazon’s app market gets going I think that will put more pressure on Google. . . that is, if Amazon’s DRM isn’t overly restrictive and negatively impacts user’s experience.

    These sites put themselves out there as a “safe place to download” from thus they have a responsibility to make certain that it is safe. They don’t have to be overly draconian about it but they do need to ensure the safety of the users. . . at least IMO.

    • samantha

      Here is an example of the power of an open platform. If people truly want a “walled garden” approach, anyone is free to set up such a market and offer it to users. Maybe Amazon will try to fill that niche. It will be interesting to see what happens on a platform where people actually have the freedom to choose such things, rather than having the manufacturer’s own ideas about how everything should work forced down their throat.

      • acupunc


        I think there is a difference between Android being an “open platform” and the “Android Market.”

        Google requires licensing to access the market, from what I understand. Furthermore, they do put forth the impression that it is a “safe” place to install apps from. It is not an app market in which just anyone can upload any app–you have to register, pay your fees, agree to terms, etc. And clearly they will pull infringing apps.

        The open platform only means that you, as a user, have the choice to do with your device as you please and hardware vendors can utilize the same OS as they please. . . therefore, you shoulder some responsibility when downloading apps from “untrusted” sites. . . one would think that Google’s Android App Market would be a trusted site ;)

        Apple’s “walled garden” is something significantly different than ensuring that the apps hosted in a market are safe and virus/malware free.

    • In general google and windows,as with countless other companies,put their implied seal of approval on ads or other forms of exposure,that give the impression that they have been vetted as to their efficacy or security.This is far from the case.So we are to either believe that they don’t know, don’t give a rat’s ass,or that anything having to do with the web could well be a hoax,a joke,a diversion or god knows what. But certainly not anything but a never-ending grain of salt.What really bothers me is that these companies that tout themselves as responsible and vigilant are really about no more than using their names to rake in more money while hiding behind a never ending blizzard of self-perpetuatin bullshit which claims to protect us from the very same.As the song says”What’s New?”