Vulnerabilities / Threats
1/11/2010
05:12 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

About 1% Of Google Android Apps Bad

Google's Android Market has less oversight than Apple's iTunes App Store, and users are expected to police the store shelves.

A warning issued last month by First Tech Credit Union that the Droid09 app in the Android Market was malware isn't that uncommon.

Unlike Apple, which errs on the side of caution when reviewing apps for its App Store, Google considers the Android Market to be an "open distribution channel" and has said that there is no pre-approval process for Android apps and minimal automated scanning to ensure compliance with Google's security model.

In the Android Market, it's up to users to find and report bad apps.

"Once an application has been uploaded by the developer and made available for users of Android-powered handsets, the Android Market community is relied on to flag applications that do not abide by our policies," Google explained to the FCC last August.

Applications that have been flagged several times -- Google has not disclosed how many times -- are reviewed by Google staff for policy compliance and, if necessary, removed within three days.

Graham Cluley, senior technology consultant at Sophos, contends that Google's "anything goes" approach, "combined with the current buzz around new phones running Android such as the Motorola Droid and the Google Nexus One, may make the [Android] platform more attractive to cybercriminals in future."

The publication and subsequent removal of apps from Google's Android Market for terms of service violations turns out to be a relatively common occurrence.

A Google spokesperson declined to provide current information about the number of applications that have been removed from the Android Market.

Google's spokesperson said the company doesn't share app download numbers as a matter of policy and was unable to provide current information about the number of apps removed from the Android Market.

But Google answered this question in part last August in its response to the FCC's inquiry into why Google Voice wasn't approved. Back then, when the Android Market had about 6,000 apps, Google said, "Approximately 1% of all applications that have been uploaded to Android Market and subsequently made available to consumers subsequently have been taken down by Google."

If that percentage remains unchanged -- which Google wouldn't confirm -- that means about 220 out of the 22,000 or so apps in the Android Market have been removed for policy violations, only some of which have to do with security.

Typical policy violations have to do with the inclusion of adult content or the unauthorized use of copyrighted material.

However, even if only a few of removed apps are actually malicious, it doesn't take many bad apps to raise security questions. Consider that according to F-Secure, the developer account associated with the Droid09 app, 09Droid, had published almost 40 variants of his or her application, each one targeting a different bank.

Apple told the FCC last summer that it rejects 20% of the apps and updates it receives as originally submitted and that 95% of apps are approved within 14 days.

Several iPhone developers have recently noted that Apple's approval process has become faster, but Apple has not released updated figures to quantify what some developers have been observing.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4692
Published: 2015-07-27
The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.

CVE-2015-1840
Published: 2015-07-26
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space cha...

CVE-2015-1872
Published: 2015-07-26
The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via craft...

CVE-2015-2847
Published: 2015-07-26
Honeywell Tuxedo Touch before 5.2.19.0_VA relies on client-side authentication involving JavaScript, which allows remote attackers to bypass intended access restrictions by removing USERACCT requests from the client-server data stream.

CVE-2015-2848
Published: 2015-07-26
Cross-site request forgery (CSRF) vulnerability in Honeywell Tuxedo Touch before 5.2.19.0_VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-automation commands, as demonstrated by a door-unlock command.

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!