Vulnerabilities / Threats
05:12 PM
Connect Directly

About 1% Of Google Android Apps Bad

Google's Android Market has less oversight than Apple's iTunes App Store, and users are expected to police the store shelves.

A warning issued last month by First Tech Credit Union that the Droid09 app in the Android Market was malware isn't that uncommon.

Unlike Apple, which errs on the side of caution when reviewing apps for its App Store, Google considers the Android Market to be an "open distribution channel" and has said that there is no pre-approval process for Android apps and minimal automated scanning to ensure compliance with Google's security model.

In the Android Market, it's up to users to find and report bad apps.

"Once an application has been uploaded by the developer and made available for users of Android-powered handsets, the Android Market community is relied on to flag applications that do not abide by our policies," Google explained to the FCC last August.

Applications that have been flagged several times -- Google has not disclosed how many times -- are reviewed by Google staff for policy compliance and, if necessary, removed within three days.

Graham Cluley, senior technology consultant at Sophos, contends that Google's "anything goes" approach, "combined with the current buzz around new phones running Android such as the Motorola Droid and the Google Nexus One, may make the [Android] platform more attractive to cybercriminals in future."

The publication and subsequent removal of apps from Google's Android Market for terms of service violations turns out to be a relatively common occurrence.

A Google spokesperson declined to provide current information about the number of applications that have been removed from the Android Market.

Google's spokesperson said the company doesn't share app download numbers as a matter of policy and was unable to provide current information about the number of apps removed from the Android Market.

But Google answered this question in part last August in its response to the FCC's inquiry into why Google Voice wasn't approved. Back then, when the Android Market had about 6,000 apps, Google said, "Approximately 1% of all applications that have been uploaded to Android Market and subsequently made available to consumers subsequently have been taken down by Google."

If that percentage remains unchanged -- which Google wouldn't confirm -- that means about 220 out of the 22,000 or so apps in the Android Market have been removed for policy violations, only some of which have to do with security.

Typical policy violations have to do with the inclusion of adult content or the unauthorized use of copyrighted material.

However, even if only a few of removed apps are actually malicious, it doesn't take many bad apps to raise security questions. Consider that according to F-Secure, the developer account associated with the Droid09 app, 09Droid, had published almost 40 variants of his or her application, each one targeting a different bank.

Apple told the FCC last summer that it rejects 20% of the apps and updates it receives as originally submitted and that 95% of apps are approved within 14 days.

Several iPhone developers have recently noted that Apple's approval process has become faster, but Apple has not released updated figures to quantify what some developers have been observing.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest September 7, 2015
Some security flaws go beyond simple app vulnerabilities. Have you checked for these?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-09
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.

Published: 2015-10-09
The Telephony component in Apple OS X before 10.11, when the Continuity feature is enabled, allows local users to bypass intended telephone-call restrictions via unspecified vectors.

Published: 2015-10-09
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.

Published: 2015-10-09
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.

Published: 2015-10-09
The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors.

Dark Reading Radio
Archived Dark Reading Radio
What can the information security industry do to solve the IoT security problem? Learn more and join the conversation on the next episode of Dark Reading Radio.