Vulnerabilities / Threats
1/11/2010
05:12 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

About 1% Of Google Android Apps Bad

Google's Android Market has less oversight than Apple's iTunes App Store, and users are expected to police the store shelves.

A warning issued last month by First Tech Credit Union that the Droid09 app in the Android Market was malware isn't that uncommon.

Unlike Apple, which errs on the side of caution when reviewing apps for its App Store, Google considers the Android Market to be an "open distribution channel" and has said that there is no pre-approval process for Android apps and minimal automated scanning to ensure compliance with Google's security model.

In the Android Market, it's up to users to find and report bad apps.

"Once an application has been uploaded by the developer and made available for users of Android-powered handsets, the Android Market community is relied on to flag applications that do not abide by our policies," Google explained to the FCC last August.

Applications that have been flagged several times -- Google has not disclosed how many times -- are reviewed by Google staff for policy compliance and, if necessary, removed within three days.

Graham Cluley, senior technology consultant at Sophos, contends that Google's "anything goes" approach, "combined with the current buzz around new phones running Android such as the Motorola Droid and the Google Nexus One, may make the [Android] platform more attractive to cybercriminals in future."

The publication and subsequent removal of apps from Google's Android Market for terms of service violations turns out to be a relatively common occurrence.

A Google spokesperson declined to provide current information about the number of applications that have been removed from the Android Market.

Google's spokesperson said the company doesn't share app download numbers as a matter of policy and was unable to provide current information about the number of apps removed from the Android Market.

But Google answered this question in part last August in its response to the FCC's inquiry into why Google Voice wasn't approved. Back then, when the Android Market had about 6,000 apps, Google said, "Approximately 1% of all applications that have been uploaded to Android Market and subsequently made available to consumers subsequently have been taken down by Google."

If that percentage remains unchanged -- which Google wouldn't confirm -- that means about 220 out of the 22,000 or so apps in the Android Market have been removed for policy violations, only some of which have to do with security.

Typical policy violations have to do with the inclusion of adult content or the unauthorized use of copyrighted material.

However, even if only a few of removed apps are actually malicious, it doesn't take many bad apps to raise security questions. Consider that according to F-Secure, the developer account associated with the Droid09 app, 09Droid, had published almost 40 variants of his or her application, each one targeting a different bank.

Apple told the FCC last summer that it rejects 20% of the apps and updates it receives as originally submitted and that 95% of apps are approved within 14 days.

Several iPhone developers have recently noted that Apple's approval process has become faster, but Apple has not released updated figures to quantify what some developers have been observing.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2808
Published: 2015-04-01
The PRNG implementation in the DNS resolver in Bionic in Android before 4.1.1 incorrectly uses time and PID information during the generation of random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a rel...

CVE-2014-9713
Published: 2015-04-01
The default slapd configuration in the Debian openldap package 2.4.23-3 through 2.4.39-1.1 allows remote authenticated users to modify the user's permissions and other user attributes via unspecified vectors.

CVE-2015-0259
Published: 2015-04-01
OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.

CVE-2015-0800
Published: 2015-04-01
The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2...

CVE-2015-0801
Published: 2015-04-01
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.