Vulnerabilities / Threats
1/11/2010
05:12 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

About 1% Of Google Android Apps Bad

Google's Android Market has less oversight than Apple's iTunes App Store, and users are expected to police the store shelves.

A warning issued last month by First Tech Credit Union that the Droid09 app in the Android Market was malware isn't that uncommon.

Unlike Apple, which errs on the side of caution when reviewing apps for its App Store, Google considers the Android Market to be an "open distribution channel" and has said that there is no pre-approval process for Android apps and minimal automated scanning to ensure compliance with Google's security model.

In the Android Market, it's up to users to find and report bad apps.

"Once an application has been uploaded by the developer and made available for users of Android-powered handsets, the Android Market community is relied on to flag applications that do not abide by our policies," Google explained to the FCC last August.

Applications that have been flagged several times -- Google has not disclosed how many times -- are reviewed by Google staff for policy compliance and, if necessary, removed within three days.

Graham Cluley, senior technology consultant at Sophos, contends that Google's "anything goes" approach, "combined with the current buzz around new phones running Android such as the Motorola Droid and the Google Nexus One, may make the [Android] platform more attractive to cybercriminals in future."

The publication and subsequent removal of apps from Google's Android Market for terms of service violations turns out to be a relatively common occurrence.

A Google spokesperson declined to provide current information about the number of applications that have been removed from the Android Market.

Google's spokesperson said the company doesn't share app download numbers as a matter of policy and was unable to provide current information about the number of apps removed from the Android Market.

But Google answered this question in part last August in its response to the FCC's inquiry into why Google Voice wasn't approved. Back then, when the Android Market had about 6,000 apps, Google said, "Approximately 1% of all applications that have been uploaded to Android Market and subsequently made available to consumers subsequently have been taken down by Google."

If that percentage remains unchanged -- which Google wouldn't confirm -- that means about 220 out of the 22,000 or so apps in the Android Market have been removed for policy violations, only some of which have to do with security.

Typical policy violations have to do with the inclusion of adult content or the unauthorized use of copyrighted material.

However, even if only a few of removed apps are actually malicious, it doesn't take many bad apps to raise security questions. Consider that according to F-Secure, the developer account associated with the Droid09 app, 09Droid, had published almost 40 variants of his or her application, each one targeting a different bank.

Apple told the FCC last summer that it rejects 20% of the apps and updates it receives as originally submitted and that 95% of apps are approved within 14 days.

Several iPhone developers have recently noted that Apple's approval process has become faster, but Apple has not released updated figures to quantify what some developers have been observing.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant