Google's Android Most Popular Target For Mobile Malware: Report

The first half of 2011 was the busiest period of malware to date as increasingly sophisticated hackers set their sights on mobile devices, particularly those using Google's Android operating system, according to a new report.

In a report released Tuesday, the cyber-security firm McAfee said malware jumped 22 percent in the first half of this year compared with the same period last year. Google's Android operating system was the most popular target for mobile malware developers during the second quarter, according to the report.

Hackers are setting their sights on Android, the report found, by disguising malware as legitimate apps. For example, a fake update of the popular game Angry Birds sends sensitive information about the user to the hacker who gains access to the user's phone and downloads more malicious software, the report found.

In early March, after several malicious apps were published to the Android Market, Google said it was taking measures to help prevent additional malicious applications from being distributed and working to fix the underlying security issues. It said the malware did not affect Android versions 2.2.2 or higher.

But in a white paper released in June, the security firm Symantec noted that Google's model for vetting apps on Android devices was "less rigorous and consequently, less secure" than Apple's iOS platform.

Namely, Google allows attackers to anonymously create and distribute malware in the Android market and relies on Android users to make important security decisions they are often not capable of making, Symantec found.

The findings come as Americans are now buying more smart phones with the Android operating system than those running Apple's iOS.

McAfee's report also found an increase in fake anti-virus software for Mac operating systems, suggesting that such malware could start appearing on other Apple products, including iPhones and iPads.

The report also said cybercriminals are continuing to buy and sell bulk email address lists to send spam. For example, one million email addresses in the United States now sells for just $25, according to the report.

Comments

[Cailleach Echo]

03:16 PM on 08/24/2011

Maybe the reason people are talking about the iPhone in this thread is because they've had problems and found that Apple does not stand behind its product. I really liked my iPhone 4 until it started to fall apart. I've now gone to htc EVO. No bugs, no problems, 24/7 free tech support from both htc and Sprint while Apple charges for their really poor tech support. Really like the unlimited usage plan.

An added bonus is that I'm not supporting the Repub/teabaggers by using ATT. Look it up - ATT gives them big bucks.

Before you decide which phone to go with, do some searching for others who have had the same problem I have had. You may be surprised at the number of really unhappy iPhone users.

If you really want an iPhone, Sprint will be getting the iPhone 5. You'll still get crappy tech support from Apple but you'll have Sprint's tech support to fall back on.

[zapwhampow]

09:10 PM on 08/24/2011

There is no substitue for excellent customer service and Sprint's tech support is awesome. I administer the phone accounts for our company and we have Sprint phones and a few Verizon phones for areas that Sprint doesn't reach. We had ATT at one point but their tech support is so suckish we're better off without it. There are some Apple supporters who keep telling me that the iPhone is the best thing on earth but what's the point of having one if you can't get it fixed when it goes on the fritz?

[Dan Vasquez]

03:00 PM on 08/24/2011

Smear piece, Android OS is Open Source with the Linux kernel. In the long run, just like with any other Linux Distro compared to OS X, the open source community responds to security issues much faster than any proprietary OS's do, that's why Symantec doesn't sell or make Linux security apps, because it's not needed.

[GeorgieMark]

04:43 PM on 08/24/2011

Before we begin I am a dual OS user I've got 2 Android devices and an iOS device.

Security updates are not the issue here, the problem is what the user installs from unknown sources (e.g. a shady app's store other than the well established ones) and what goes up on the official Android Market itself.

Google does not vet apps, that's a well known fact. It is up to the Android community to flag inappropriate apps.

Google does however notify what the app accesses on your device, once you press download.
E.g. if app X requires full internet access, or to modify folders, prevent the phone from going to sleep mode, or even reads your contacts list, these will be visible to the user. In fact Android Market asks for the user's permission before X begins to download. If the user accepts (thereby permitting X to do all those things I mentioned) the download begins, if not your order is cancelled.

Likewise if someone creates a data harvester (ergo requires access to your contact list),and masquerades it as a wallpaper, Google is still able to determine the permissions' set the app requires and that info will be available to the user. So if you happen to download a wallpaper that requires full internet access and reads your contact list, chances are you've stumbled on a data harvester and you shouldn't install.

However most people do not bother reading the permissions and download willy nilly.

[garypreviewpage2]

01:31 PM on 08/24/2011

i call shenanigans.
1. McAfee puts out the report twice a year at this point. They always release this report about 2 days before a new version of their antivirus software hits the Android market.
2. I know like a million people with android phones. I have yet to even hear 1 person say that they were affected by malware in any.

i'm telling you. this is a bunch of crap.

[Eris23]

01:54 PM on 08/24/2011

They open the report with talk of LulzSec and Anonymous. It's actually quite amusing if you read it. :)

[Woodn88s]

12:06 PM on 08/24/2011

I've had an android for approx 6 mos. Samsung captivate...............It has it's plus's but I'm going Apple all the way very soon, just so full of bugs.
Anyone want an android phone cheap in great shape?

[Kamereon]

11:26 AM on 08/24/2011

No surprise here. Apple products are so expensive there's no point in targeting them - those owners are broke.

[CaptainObvvious]

11:35 AM on 08/24/2011

Devices running iOS are priced right there with their competition... They are even cheaper than some.

[Kamereon]

01:52 PM on 08/24/2011

Wait a minute, a Jobs fanboy finally admitting that there is competition?! Wonders never cease.

[waukonwhite]

10:58 AM on 08/24/2011

Best estimates are that half a million Android phones where infected by malware over the last six months. You can make the argument that this number is a result of Android market share, which would be partially true, but it's also easy to distribute malisious software with Android. These two factors combined are going to make it popular with the criminal types.

Another problem is that once a security hole is discovered and patched how quickly will users get an update? With the fragmentation that has occurred around the Android OS there could be significant delays depending on the vendor.

Security concerns with Android are legitimate. Security departments in most enterprises are going to approve an iOS device over an Android device simply because of full device encryption, device management capabilities, and the "walled garden" approach to application deployments. They would prefer people using a RIM device instead but also understand the shift in user expecations that is occurring. iOS devices then become the lesser of the evils because there are at least some controls available to mitigate risk.

On a final note, any device can be cracked given physical access and enough time. The best defences are a strong pin, full device encryption, and wipe. Set your device to wipe after several failed pin attempts and if possible set up the ability to remote wipe.

[Dan Vasquez]

03:03 PM on 08/24/2011

Since Android is an Open Source OS, there should be encryption available if not it will be soon.

[Kamereon]

04:47 PM on 08/24/2011

Long...eh, reply? I feel like you are responding to a question that I posed instead of the jest at Apple's expense. Other than jesting, the only thing said was my commentary on the expense of Apple products compared to what goes into them.

The company I work for has a 100k people. There isn't a single iOS device employed by our company. Lenovo and HP laptops, upper management uses RIM devices and regular employees use a variety of Motorola products (Sprint/Nextel network). I regularly network with other companies, and as of yet, have never seen an iOS product issued by anybody's IT dept.

I've recently overhead and NPR show that discussed that employees are bringing in their own iOS devices and asking if they can use them for work. The answer for the most part has been no. Usually because of established policies regarding security, protocol, and repairs of said devices. The demand is there, so, eventually iOS will catch on in the corporate environment. Not so much due to the security of iOS, but due to the popularity of iOS devices and the lack of innovation from RIM.

[RattleCat]

10:38 AM on 08/24/2011

Either Google nips this in the rear now, or it will directly affect consumer purchases in the long term.  No one wants to spend money on a smart phone that is easy pickings for hackers.  And no one wants to burn valuable memory and battery time on a continuously running malware scanner.

[theveggiedude]

12:14 PM on 08/24/2011

The only way to 'nip this' is to make it a walled garden, like Apple does, and that isn't gonna happen. Even Motorola's CEO suggested this a couple months ago in praise of the Apple model.

[Dan Vasquez]

03:06 PM on 08/24/2011

The 'Walled Garden' is marketing BS, just a way to leech money off developers.

[six seven]

10:32 AM on 08/24/2011

Setting brand loyality aside.. As consumers, we all benefit from choice. Choice drives innovation and keeps costs down. The following link shows why it's important for all of us to have a third, strong option in the mobile market. Interesting read:

Why Microsoft Is the Vital New Underdog in Mobile Computing: http://www.xconomy.com/national/2011/08/19/and-then-there-were-three-why-microsoft-is-the-vital-new-underdog-in-mobile-computing/?single_page=true

[crayola 08b]

10:26 AM on 08/24/2011

well, it's official, Android is now the microsoft windows of mobile os's.

[PhillyKing]

10:29 AM on 08/24/2011

meaning it's the dominant os so more malware is written for it as anyone would go after the bigger payout?? or were you just trying to be snarky?

[crayola 08b]

11:31 AM on 08/24/2011

oh i'm definitely being snarky. it's just funny how certain android owners refuse to acknowledge the fact that if it weren't for the iPhone they wouldn't be able to enjoy their malware ridden imitation.

[MIKEinNYC]

10:21 AM on 08/24/2011

There should be serious prosecutions with jail-time as to the miscreants who do this to other people's equipment. How many hard drives and computers have been ruined and junked because of these viruses and malware? And now phones!

When you come right down to it, these activities are the equivalent of theft and should be treated accordingly.

[Dan Vasquez]

03:07 PM on 08/24/2011

Not enough people in law enforcement are smart enough to catch them and most of it comes from overseas.

[GeorgieMark]

09:16 AM on 08/24/2011

Oh well. Off we go again.

As a computer user for over 20 years now (first PC was IBM XT the successor of the original IBM PC) I never experienced the inconvenience of virus/trojan/malware attack on any of my systems (a couple of Macs in there as well).

Granted that back in the days of IBM PC XT when someone said your computer is under attack it generally meant that someone was clobbering it with a baseball bat.

But I digress. A system is only as capable as its user. You can't expect your software vendor to render their system 100% safe, apple hasn't done it, neither has google and certainly not Microsoft. It's just like driving a car no matter how many security features Volvo/VW/Toyota/Ford adds to their models, reckless driving is a sure fire way of getting seriously hurt.

[theveggiedude]

12:17 PM on 08/24/2011

No one is asking for 100% security. But leaving your door wide open all the time is inviting trouble, and trouble is what they got now.

[Eris23]

12:27 PM on 08/24/2011

Do you even understand how the Android security system works? It every much is more of a user problem.

http://downloadsquad.switched.com/2010/06/28/understanding-the-android-market-security-system/

[GeorgieMark]

01:59 PM on 08/24/2011

Nope it's still down to the user.

The Android binary has a built in set of tools that allows Google to determine what sort of personal information each app has access to. This cannot be masked, or tampered with.

See an example, the economist's app click on the permissions tab.
https://market.android.com/details?id=uk.co.economist&feature=banner

Now if you -as an Android user- choose to download the Economist's app from your phone/tablet once you hit download you'll be presented with a pop-up window showing the full list of what this app has access to in plain simple english.

The system will request whether you accept or decline these permissions if you accept, the download begins, otherwise your download is cancelled.

I'll admit that most users do not even bother reading the permission's set and just press accept, but if you don't know what you're installing then you're begging for trouble.

If any hacker writes an app that collects personal data and masquerades it as let's say a wall paper, Google is still able to determine what sort of access that app requires and that information is available to the user the moment the app is listed, so if you happen to come across a wallpaper that requests full internet access and reads through your contact's list, don't install it! Chances are you've stumbled upon a data harvester.
As always a smartphone is only as smart as its user.

[Daw8it]

02:12 AM on 08/24/2011

Funny thread...McAfee talks about Android's vulnerable OS and all the Android users can do is attack Apple's iphone.
Fix your crappy OS first ...then talk about the others.

[inguatu]

08:28 AM on 08/24/2011

McAfee is trying to sell units. This is no different than the Mac trojan which was requiring people to give it permission to install itself on their machines. It has nothing to with the OS itself. It's the market place not being properly monitored by Google and its the users who are downloading blindly and installing asian bikini wallpaper "apps" which is requesting full access to their phones. Also, 90%+ of reported Android trojans are in unapproved Chinese marketplaces where cracked apk's can be found.

So before running your mouth, learn and understand the facts. Don't be a sh33p.

[PhillyKing]

10:31 AM on 08/24/2011

fix urs so that it could actually function first... how's that surfing only 30-40% of the interwebs working for you??? got flash??

[CaptainObvvious]

11:37 AM on 08/24/2011

Such ridiculous numbers.

I have used an iPhone almost 5 years... I rarely if EVER encounter a site I can't visit because of Flash... When I rarely encounter a video I can't watch I can still view the video using an app that will run flash videos.

Its sad you have to make numbers up and be hyperbolic to get your point across.

[theveggiedude]

12:19 PM on 08/24/2011

How's that 16-bit color going for you? Hope you get 24-bit one day.

[ResearchtheFacts]

01:56 AM on 08/24/2011

Hack n Mod giving up $2,000 to anyone who can port Android to TouchPad. Which lead me to ponder why nobody is trying to port iOS on other devices or whatever that giant phone gui thing is on Apple? Nobody is trying to emulate it.

[CaptainObvvious]

08:13 AM on 08/24/2011

Well Android is open source and iOS isn't...

This particular line of attack is comical. Sure its fast, smooth, intuitive and incredibly stable but you don't think the desktop is flash enough so it must suck huh?

[inguatu]

08:16 AM on 08/24/2011

This particular line of attack is sad. Your comment made absolutely no sense,, yet you cling to this brand loyalty to Apple as if anything negative said against them is a personal attack on your own being. Very sad when you let a company define you.

[ResearchtheFacts]

12:03 AM on 08/24/2011

With 52% market share compared to Apple's meager 29% it is Android world. That's almost double the users despite Apple's constant insane advertising. Every other freakin commercial.  Not working!  Every time Apple plays a commercial 5 more users flock to Android.

Oh, and there was the nastiness of trying to pick off manufacturers using Android as their OS. That backfired nicely. Now with WebOS as we speak on the touchpad being ported to Android, its game over. 270,000 alone at Best Buy and sold out all over the web unless you want to pay full price.

Now they will have to go back to the drawing board and come up with a real OS. Nobody wants a large phone screen on a tablet. As far as malware someone stole an Apple product and blew right past the password and encryption. It doesn't get any worse then that. You can always get free antivirus apps for scanning apps before loading them on your device. That will stop the malware immediately.

[Marc Driftmeyer]

06:13 AM on 08/24/2011

With 52% of market share they possess < 25% of the Profits. Apple possesses greater than 60% of the profits.

[inguatu]

08:18 AM on 08/24/2011

Profits don't mean much in the long run. Look at other companies who were making large profits at the expense of their customers. Eventually every monopoly runs its course. Check the history on "tech" companies and you'll see a pattern. Apple, while making more money now is on an intellectual decline and losing step with their customers.

[Marc Driftmeyer]

06:14 AM on 08/24/2011

You're so full of crap about encryption on the iPad or more specifically iOS. I speak as a former NeXT/Apple Engineer.

[eShirl]

09:10 AM on 08/24/2011

LOL!

[jsgaetano]

10:48 PM on 08/23/2011

Guess the hackers know Apple will always be a niche market.

[CaptainObvvious]

07:11 AM on 08/24/2011

iPhone 4 is the best selling smartphone in the world
iPhone 3GS is the second best selling smartphone in the world.

Even the newest and best Android phone doesn't sell as many units as a two year old iPhone.

[jgeurian21]

09:25 AM on 08/24/2011

Sure the iPhone is the most popular device, but not the most used. Then again the 3GS is free and new Droid phone are not.

[jsgaetano]

10:53 AM on 08/24/2011

Actually, Android surpassed iPhones a while back. If you want to properly compare, you have to do total sales of all Android phones, because Apple is the only iOS device manufacturer.