Google throws 'kill switch' on Android phones
Automatically deletes more than malware-infected apps downloaded by users
Computerworld - For only the second time, Google last weekend remotely deleted Android apps from users' phones.
Google made the move to erase malware-infected applications that users had downloaded from the Android Market, the company's official e-store.
Last Wednesday, Google removed more than 50 infected apps published by three different developers from its marketplace, but didn't trigger automatic uninstalls until several days later.
In many cases, the malicious apps were bogus versions of legitimate programs that had been recompiled to include malware, or as a Symantec researcher said last week, "Trojanized."
According to San Francisco-based smartphone security firm Lookout, between 50,000 and 200,000 copies of the apps were downloaded by users before Google yanked them from the Android Market.
Google has thrown the Android app "kill switch" only once before: In June 2010, it yanked a pair of apps it said were published by a security researcher, who "intentionally misrepresented their purpose in order to encourage user downloads."
In that case, however, the apps were not designed to be used maliciously, and did not request permission to access private data.
According to Lookout, which has been analyzing the infected apps since last week, the recently-pulled-and-uninstalled apps not only demanded extended permissions, but also made off with a wide range of information from the infected phones. Among the data pulled by the infected apps: the phone's IMSI (International Mobile Subscriber Identity) and IMEI (International Mobile Equipment Identity) numbers, unique identifiers of the subscriber and smartphone.
After one of the infected apps is downloaded and installed, the phone also surreptitiously downloads a second-stage with "one or two root exploits," said Kevin Mahaffey, the CTO of Lookout, that give attackers complete control of the device.
"I don't know if the hackers were joking when they named [the malware] DroidDream, but the second-stage only downloads between 11 p.m. and 8 a.m., when most users are asleep," said Mahaffey. He speculated that the timing was to insure users didn't notice any unexplained network activity while that stage was downloaded.
Besides pulling the kill switch, Google is also pushing an app of its own, dubbed "Android Market Security Tool March 2011," to all affected Android phones, said Rich Cannings, the head of Android's security team, in a blog post Sunday.
- Review: 5 video editing apps for Android
- Malware-infected Android apps spike in the Google Play store
- Nokia plans forked Android smartphone for Barcelona unveiling
- LG G Flex deep-dive review: The curious case of the curved phone
- Xperia Z1S deep-dive review: A stylish phone with power and panache
- Low-end smartphone battle forces Nokia to Android
- Moto G real-world review: The best budget phone money can buy
- Google escalates offensive against Office with Android 'KitKat'
- Galaxy Note 3 deep-dive review: A plus-sized phone with perks and quirks
- LG G2 deep-dive review: Extraordinary hardware in an ordinary phone
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts