Jury Still Out On Mobile Adware

On Friday, security firm Symantec warned that a baker's dozen of applications available through the Android Marketplace hosted a "bot-like threat" that could leak information.

With an estimated 1 million to 5 million installations, the threat -- dubbed Counterclank by Symantec -- would have been one of the largest outbreaks of mobile malware to date. Yet other security firms disagreed over the details: The affected programs incorporated third-party software that was not malicious but comprised "an aggressive form of ad network," concluded mobile security firm Lookout.

The incident highlights that uncertain gray areas continue to inhabit the space between what is definitely a legitimate mobile application and what is purely malicious.

"I think we are in a place where people are being very experimental, and people are coming up with new ideas for a new platform," says Tim Wyatt, a principal engineer at Lookout. "We will definitely see ideas that push the boundaries of what is acceptable and what is not."

The debate follows a similar trajectory as the concerns over spyware, adware, and unwanted programs that plagued PC users at the beginning of last decade. In the early 2000s, the infamous affiliate adware maker 180Solutions, later known as Zango, paid partners to install its software on systems, which they often did without the users' permission.

In a similar way, some mobile advertising platforms perform functions that users would likely not want, if they had a choice. Counterclank, which is actually the Apperhand software development kit, collects the international mobile equipment identifier (IMEI) and uses the push notification mechanism to send personalized ads to the user's device. Software using the development kit also leaves a search icon on a mobile device's desktop and can modify bookmarks.

The last capability is unacceptable behavior but not malicious, Lookout states in its analysis.

Other companies agree. Counterclank may not be malware, but its definitely unwanted, says Roel Schouwenberg, senior researcher with security firm Kaspersky. The company classifies the program, not as malicious, but as something that users would not want on their mobile device. Whether that determination stays constant is an open question, he says.

"It is definitely grayware," Schouwenberg says. "We haven't quite hashed out yet whether [programs using it] are malicious or not. We are currently detecting it, but I would not be surprised if somewhere down the line, we decide not to detect it or detect it in a different way."

On the Android platform, many security firms focus on the types and number of permissions requested by programs as an initial indicator that something may be amiss. However, permissions by themselves are not sufficient, says Schouwenberg.

"We see quite a lot of apps out there that ask for a ton of permissions," he says. "Developers are copy-pasting the permissions list off of a template, and going with it, when in reality, they will never use some of those permissions."

Yet, permissions that seem excessive -- such as GPS tracking, connecting to an Internet server and the ability to read data from the phone -- are actually necessary, argues some developers. Full-function advertising platforms need to assign a user a unique ID and offer other benefits to their clients, argues mobile advertising software maker Mobclix.

"GPS activation, Internet connectivity and read phone state, when accessed, are not signs you’ve accidentally put malware into your application," the company writes in a blog post. "They’re usually legitimately accessed – along with other data and functions we rarely think about."

As mobile application development -- and the business models that drive it -- matures, the gray area will shrink, says Schouwenberg. In addition, customer concerns will likely drive developers to focus on reducing the expansive permission sets that are currently the norm.

"Quick growth and security generally don't go hand in hand," he says. "When the rapid growth starts winding down a bit, that's when Google [and developers] will look and see what they can improve on."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.