News & Analysis
Comment
Saon Islam
Android users beware, more than 50 mobile apps in the official Android Market ...
Nicholas.Lee
Now that they have used the dubious excuse of 9:11 to put GPS tracking of every ...
More than a third of Android apps host malware
Rick Merritt
7/27/2012 8:09 AM EDT
MIAMI – More than a third of all Google Android applications contain some form of malware, according to tests conducted by BT. A security expert for the U.K. telecom service provider said it expects to test apps for other mobile operating systems and find similar results.
“We analyzed more than 1,000 Android applications and found a third compromised with some form of active or dormant malware,” said Jill Knesek, head of the global security practice at BT. “Almost every device is compromised with some kind of malware, although often it’s not clear if that code is active or what it is doing,” she said in a panel discussion at the NetEvents Americas conference here.
Wayne Rash, a technology journalist moderating the panel, said he was reviewing a Samsung Galaxy S3 handset and found malware in an Android applications provided by Google. “This is a device considered by some people to be the best smartphone on the market right now,” Rash said.
“There’s plenty of anti-malware software available for Android and other mobile operating systems, but companies don’t often insist on using it,” Rash added.
Malicious code is just one example of the many security vulnerabilities in mobile systems. GPS devices can also be hacked, said Knesek.
“It’s going to take one young woman to be stalked, raped and killed before people realize the need security on GPS,” said Knesek a former cybersecurity expert for the U.S. FBI who worked on the Kevin Mitnick case.
Indeed, a U.S. researcher testified before Congress last week about the security holes in civilian GPS. At least a dozen presentations at this week’s Black Hat conference talked about vulnerabilities in mobile systems.
Even security technologies working their way out of the lab, such as biometrics, have their vulnerabilities. “I think hackers will steal biometrics with man in the middle hacks--handsets need to be encrypted end-to-end as the Backberry does,” she said.
The good news is thanks to the latest deep-packet inspection (DPI) chips, a new wave application-aware firewalls is emerging from companies including Cisco Systems, Juniper Networks and Palo Alto Networks. The chips can detect and block individual applications, said Jurrie van den Breekel, a director of marketing for test specialist Spirent Communications (Calabasas, Calif.).
“We see this as a very big market, and we get a lot of demand for testing the technologies,: said van den Breekel, speaking on the panel. “You will be able to select what kind of app you allow--you can block DropBox and Skype, for example, to prevent corporate data from winding up on those services.
One Latin America service provider already uses DPI to create separate mobile data packages for email and social networking apps such as Facebook and Twitter, said van den Breekel.
“Service providers will have the option to allow access to only certain apps—they will offer one thing and block the rest,” he said. “We are just at the very start of this trend,” he added.
“We analyzed more than 1,000 Android applications and found a third compromised with some form of active or dormant malware,” said Jill Knesek, head of the global security practice at BT. “Almost every device is compromised with some kind of malware, although often it’s not clear if that code is active or what it is doing,” she said in a panel discussion at the NetEvents Americas conference here.
Wayne Rash, a technology journalist moderating the panel, said he was reviewing a Samsung Galaxy S3 handset and found malware in an Android applications provided by Google. “This is a device considered by some people to be the best smartphone on the market right now,” Rash said.
“There’s plenty of anti-malware software available for Android and other mobile operating systems, but companies don’t often insist on using it,” Rash added.
Malicious code is just one example of the many security vulnerabilities in mobile systems. GPS devices can also be hacked, said Knesek.
“It’s going to take one young woman to be stalked, raped and killed before people realize the need security on GPS,” said Knesek a former cybersecurity expert for the U.S. FBI who worked on the Kevin Mitnick case.Indeed, a U.S. researcher testified before Congress last week about the security holes in civilian GPS. At least a dozen presentations at this week’s Black Hat conference talked about vulnerabilities in mobile systems.
Even security technologies working their way out of the lab, such as biometrics, have their vulnerabilities. “I think hackers will steal biometrics with man in the middle hacks--handsets need to be encrypted end-to-end as the Backberry does,” she said.
The good news is thanks to the latest deep-packet inspection (DPI) chips, a new wave application-aware firewalls is emerging from companies including Cisco Systems, Juniper Networks and Palo Alto Networks. The chips can detect and block individual applications, said Jurrie van den Breekel, a director of marketing for test specialist Spirent Communications (Calabasas, Calif.).
“We see this as a very big market, and we get a lot of demand for testing the technologies,: said van den Breekel, speaking on the panel. “You will be able to select what kind of app you allow--you can block DropBox and Skype, for example, to prevent corporate data from winding up on those services.
One Latin America service provider already uses DPI to create separate mobile data packages for email and social networking apps such as Facebook and Twitter, said van den Breekel.
“Service providers will have the option to allow access to only certain apps—they will offer one thing and block the rest,” he said. “We are just at the very start of this trend,” he added.
|
|
|
|
|
Navigate to related information
junko.yoshida
7/27/2012 9:19 AM EDT
The story quotes a former cybersecurity expert for the FBI saying: "It’s going to take one young woman to be stalked, raped and killed before people realize the need security on GPS.”
This is troubling -- to say the least.
Sign in to Reply
wilber_xbox
7/27/2012 10:13 AM EDT
correct Junko, such quotes are irresponsibility on anyone's part.
Sign in to Reply
Patk0317
7/28/2012 4:29 PM EDT
How is this irresponsible, unless it is a scare tactic to sell anti virus SW? I think a former FBI employee has pretty good credibility.
Sign in to Reply
jluster
8/1/2012 12:14 PM EDT
It is irresponsible because it creates a scare where there should be education. Nothing Mrs. Knesek mentioned is actually "malware". The definition of malware is "software that does bad things". Not "software that does as it is told". Heck, BT themselves backpedaled on her comments. And if you think the FBI is credible on those things then ask yourself why they, themselves, are so widely hacked and "owned". BT HAS a financial interest in people being scared because THEY sell security practices.
Sign in to Reply
I_B_GREEN
8/1/2012 1:31 PM EDT
A hook is a hook is a hook
Sign in to Reply
goafrit
7/28/2012 8:06 AM EDT
And it is not just a woman. People give their kids phones these days. So, this risk is very broad.
Sign in to Reply
wilber_xbox
7/27/2012 10:15 AM EDT
Even though i do not contest the trustfulness in this report but this is good old scare tactics and probably upcoming market for security firms.
Sign in to Reply
goafrit
7/28/2012 8:08 AM EDT
No. That is not true. Everyone knows in the industry that this problem exists. Even Apple Store fights with this daily despite having the practice of personally approving the apps. Let them fix their problems.
Sign in to Reply
eewiz
7/27/2012 1:10 PM EDT
The entire business model of Android for Google revolves around gathering your private information so that they can show you more targeted ads. So
All Android phones are intended to collect your private data in a supposedly anonymous way. When google itself do this, can you blame the 3rd party app developers on taking your private data and trying to monetize it? Thats why all enterprise customers go for iOS/Blackberry.
Sign in to Reply
junko.yoshida
7/27/2012 1:17 PM EDT
You do have a point. If you are so willing to share your own data with the rest of the world (in other words, "you open the door"), you probably don't have much leg to stand on.
Sign in to Reply
I_B_GREEN
8/1/2012 1:34 PM EDT
But all this is hidden from the average user.
People reading this should be a few notches up the fodd chain of software/hardware, but even we have difficulty understanding all this.How is your grandma supposed to figure it out?
Sign in to Reply
I_B_GREEN
8/1/2012 1:35 PM EDT
The hooks need to be bullet proof and encripted so that they cannot be used in anyway but the end aggrigator
Sign in to Reply
t.alex
7/27/2012 3:31 PM EDT
Android play store really needs rigorous approval process. Apple has been doing this and definitely the apps are pretty clean.
Sign in to Reply
Sanjib.Acharya
7/28/2012 10:20 AM EDT
How is Apple checking it? Is it only the rigorous approval process for the apps vendor to comply with or by means of some smart application to catch and control malwares?
Sign in to Reply
t.alex
8/1/2012 2:27 PM EDT
Every app submitted will be evaluated by some app reviewer. This is done against a long checklists, so if your app just shows some information with some random button it will definitely rejected. In terms of privacy, if the app access user location, the system will pop up notification to ask for permission. So the user is making a conscious choice whether to allow or not.
Sign in to Reply
rick.merritt
7/27/2012 7:23 PM EDT
There are shades of grey here.
We unofficially and maybe unconsciously contract with Google and other Web 2.0 companies when we use their Web services, letting them data mine our preferences.
With malware third parties that run the gamut from entrepreneurs to those with malicious intent try to jump on the bandwagon as it rides past. So far the damage has not been great enough to drive people away, but...
Sign in to Reply
DrQuine
7/28/2012 1:14 AM EDT
The article title is scary ... but is the malware a technical violation of data privacy (consolidating data without explicit permission) or is it actually capturing and exploiting private data for identity theft or other illegal activities? More details are needed to determine whether these are scare tactics laying the groundwork to justify selling scanning software or a representative sampling of compromised Androids.
Sign in to Reply
mmathieum
7/28/2012 11:44 AM EDT
This article is ridiculous.
If Google's Android apps had malware, I think we knew that by now
Android is open but it doesn't mean that any app can do whatever they want.
Even anti-malware software apps can't do much since they are just regular apps and don't have the right to control other apps (except if pre-installed on the device as a system app or if the device is rooted).
Sign in to Reply
daleste
7/28/2012 4:03 PM EDT
So it there anti virus software for our android devices?
Sign in to Reply
Patk0317
7/28/2012 4:26 PM EDT
This is concerning. I may swap out my Galaxy for an iPhone 5 when available.
Sign in to Reply
hdibani
7/29/2012 6:53 AM EDT
IOS has the most zero day vulnerabilities of any mobile OS. not sure that is a smart idea.
People are jailbreaking their phone (ie modifying the system on the phone) just by visiting a website.
http://web.nvd.nist.gov/view/vuln/search-results?query=ios+apple&search_type=all&cves=on
Sign in to Reply
chanj
7/28/2012 10:00 PM EDT
The question is what information can be accessed by malware. Everyone will have concern on saved password be accessed. Will you have concern if your contact list (aka address book) is accessed? We definitely need to pay attention to our connected devices; yet, we shall react and draw a conclusion too quick too soon. I would love to read the report from BT that shows the detail of study and which apps are the suspect.
Sign in to Reply
http://www.lulu.com/spotlight/poconoarmchairreview
7/29/2012 12:57 AM EDT
Would people pay for a certification and a guarantee that a product has no malware or spyware? Whose guarantee would be trusted? Or would be enforceable?
Sign in to Reply
hdibani
7/29/2012 7:00 AM EDT
I would like to know what definition of malware was used by researchers. if they include adware in there as malware, then this result is to be expected.
Sign in to Reply
rick.merritt
7/29/2012 4:29 PM EDT
Malware is unauthorized software from third parties attempting to get a user's computer to do something malicious the user is not aware of.
It does not include preference monitoring by the Web service provider the end user is accessing.
Sign in to Reply
kinnar
7/29/2012 2:49 PM EDT
After selling operating systems for 20years without antivirus solution, Microsoft had realized the necessities of designing security solution running by the OS designer/developer only.
Similar way the security solution is an acute need for mobile/tablet platform designed by Google.
I hope that they will realize the need in a early stage.
Sign in to Reply
Bert22306
7/29/2012 6:02 PM EDT
Quoting the article:
"GPS devices can also be hacked, said Knesek.
“'It’s going to take one young woman to be stalked, raped and killed before people realize the need security on GPS,' said Knesek a former cybersecurity expert for the U.S. FBI who worked on the Kevin Mitnick case."
I don't understand what he's saying.
The problem with the GPS signal being hackable, i.e. unauthenticated, which is the source of controversy and discussion, is NOT that someone's location can be determined by someone else. It is that GPS users in a given general area can be provided with bad location info.
How this makes a mobile device user more stalkable, I don't know. What might make such a user more stalkable is a nonsecure cell telephone, texting, or web browsing comm link, in which comm link divulges that user's GPS location. But authenticating the GPS signal won't help this scenario at all. The only thing that would help is encrypting the cell phone or texting or other apps.
GPS is a one-way broadcast signal, satellites to users. That's all. Nothing goes out from the user' mobile device when that users receives GPS data, UNLESS some other application in the device uses the location data and in turn transmits it out.
Sign in to Reply
eewiz
7/29/2012 9:54 PM EDT
Some of the GPS devices has integrated 3G/GSM data devices for accessing other online services like live traffic estimation.
Sign in to Reply
Bert22306
7/30/2012 3:00 PM EDT
Exactly.
So it is the GSM or other two-way cell phone link that needs to be encrypted, and not at all the GPS broadcast (one-way) link. That was my point.
Sign in to Reply
Bert22306
7/30/2012 3:05 PM EDT
I mean, to prevent the user of this cell phone from being vulnerable to stalking, of course.
The reason to authenticate the GPS broadcast is different. It is to prevent a hacker from introducing fake GPS position information. But that would not be targetted to just one user device, unless that one user device is the only device in that general area. Any device within range of the hacker's signal would be equally vulnerable.
Sign in to Reply
Larry M
7/30/2012 4:35 PM EDT
I think the attack that's being described here involves GPS but GPS itself isn't being hacked. The malware initiates GPS tracking. That is, it samples location periodically and surreptitiously sends it (e.g., via silent text message or http) to a stalker.
Sign in to Reply
Larry M
7/30/2012 4:37 PM EDT
And, I should have added, encryption won't help here. The only way to solve this problem is to prevent the malware from unstalling in the first place.
Sign in to Reply
Duane Benson
7/30/2012 12:44 PM EDT
Once again, our cool technology is a double edged sword. Are there any single edged swords?
Malware or not, these phones can allow trouble to happen.Photos can have location and time data embedded in them. Unsecure texts or Twitter posts can expose such information. All of the marvelous capabilities in the smart phone in my pocket could make my life so much easier while at the same time making my entire life much more vulnerable to theft and or exploitation.
Sign in to Reply
rick.merritt
7/31/2012 11:33 AM EDT
Indeed, security experts know for every measure there is a countermeasure and on and on. The issue is how high or low are the walls to your castle.
Sign in to Reply
amrs
7/30/2012 8:31 PM EDT
So did anyone actually buy these wild claims that BT seems to have retracted already, for example http://www.zdnet.com/bt-backpedals-on-claims-almost-every-android-device-has-malware-7000001837/
Seems like a FUD campaign to me. So really the question is, whose? Should the headline start with "According to Apple,..." or perhaps "According to Microsoft,..."?
Sign in to Reply
http://www.lulu.com/spotlight/poconoarmchairreview
7/31/2012 5:02 AM EDT
When it reaches 50% malware, they will start calling it Windows.
Sign in to Reply
rick.merritt
7/31/2012 11:32 AM EDT
LOL!
Sign in to Reply
speculatrix
7/31/2012 12:00 PM EDT
I think this is mostly FUD
although of course they might have been analysing apps illegally posted on warez and torrent sites rather than from the android market in which case it is not a surprise.
Sign in to Reply
Robotics Developer
7/31/2012 2:10 PM EDT
Until someone gets hurt either financially or personally then the issue like they say " that dog won't hunt". I also was wondering what the effect on the performance of the android machines the "malware" software was causing and what was it doing? It was not clear to me from the article that they knew what all the rogue software was doing (if anything). It does not surprise me that there are those who will try to piggyback on software to get access to machines, what does surprise me is this is the first I have heard of it on Androids.
Sign in to Reply
Sparky_Watt
8/1/2012 6:40 PM EDT
I recently saw an article on Android Anti-Virus Software. It pointed out that EVERYTHING in an Android is sandboxed. Therefore an Anti-Virus program can't see the programs it is trying to detect, by definition. Malware can't see your information, unless you say it can. What is crazy to me is that there are so many apps out there that require every permission in the book. On the one hand, that should set anyone's suspicions off. On the other hand, users shouldn't be required to look at a laundry list of permissions to decide whether a specific app should have them. Most are unable, and many have both legitimate and illegitimate uses. So, a program that uses it legitimately could use it illegitimately as well.
The best answer, I am sorry to say, is to take all those permissions away. I can be identified by my GPS location alone (I spend time at home, right?) any app that can see both my GPS and the Internet could be a stalking tool. The only solution is for the apps to be code inspected by a third party certification agency. Then the distribution package gets compiled by the App Store from the inspected code. The developer pays for this and doesn't know who the inspector is, of course.
It may sound extreme, but it is the only solution that will allow full flexibility in the apps and block the potential abuses.
Sign in to Reply
Neo1
8/2/2012 3:21 AM EDT
Or as pointed out we should start by defining that end to end encryption is mandatory for every service which needs user info. This should by default be built into the application itself.
Sign in to Reply
Nicholas.Lee
8/4/2012 11:59 AM EDT
Now that they have used the dubious excuse of 9:11 to put GPS tracking of every citizen into your phones, they now want to use the dubious excuse of malware and other scare tactics to make everyone have privacy-invading DPI chips in every phone.
If they do much more to "protect us" then we will be so repressed and have so few rights that we won't have a life worth protecting.
All we need is good, strong, open-source encryption.
If mobile software has vulnerabilities then it should be open-sourced so the community can fix it.
Sign in to Reply
Saon Islam
8/29/2012 2:56 AM EDT
Android users beware, more than 50 mobile apps in the official Android Market have been discovered containing malware that could have compromised sensitive and personal data. While Google has already yanked the apps from the Market, this first big infection highlights the inherent vulnerability of Android's openness to developers. Check here for more info http://drawsomethingcheat.eu
Sign in to Reply