Android has become a target for malware writers who find its open market system, as well as the multiple unofficial app markets, an effective way to spread malicious software. Photograph: Alamy
Two online security companies are arguing over whether as many as 5m Android handsets are infected with malware produced by a publisher via its official app Market – or just part of an "aggressive" advertising network.
Symantec said that "multiple publisher IDs on the Android Market … are being used to push out Android.Counterclank", which is software that it says is "a bot-like threat" which can also steal information from devices.
But Lookout Mobile Security, which specialises in mobile and the Android sector, disagrees: "We disagree with the assessment that this is malware, although we do believe that the Apperhand SDK [contained in the apps] is an aggressive form of ad network and should be taken seriously."
The dispute indicates that the conflict about the difference between malware and "adware" – where software on the user's computer generates intrusive advertising – has shifted from the desktop, where the line has been blurred over the years, to the mobile platform, and particularly to Android, the mobile operating system which increasingly dominates world sales of smartphones.
At the same time, it reinforces concerns that Android has become the target for malware writers who find its open market system, as well as the multiple unofficial Android app markets, an effective way to spread malicious software. Both Symantec and Lookout Mobile offer free apps to protect smartphones against malware – which is an increasing threat: another security company, McAfee, noted in a report in November (PDF) that in the third quarter of 2011 "Android became the exclusive target for all new mobile malware", noting that while Nokia's Symbian has the largest total – due to its broad installed base – the number of separate Android malware threats had grown from fewer than 20 new appearances in the third quarter of 2010 to nearly 100 in the same period in 2011. No report has been issued yet for the fourth quarter of the year.
At issue in the dispute between Symantec and Lookout Mobile are apps apparently from three publishers – iApps7, Ogre Games and redmicapps, where Symantec has identified 13 apps that it thinks pose a threat. Symantec said the "Counterclank" malware contained in the games is a variant of "Tonclank", which it first identified on 10 June 2011 and said "may open a back door and download files onto Android devices … [and] steals information from Android devices." Counterclank could push "unwanted ads" to devices and steal browser history, bookmarklets, account details, settings, phone number and other information. It can send that information to apperhand.com – a site whose owner details are hidden and whose home page provides nothing except the phrase "Hello World!".
None of the publishers appears to have its own site, though that is not required to publish to any app store. But the lack of a company supporting the apps could raise suspicions about how bona fide they are.
Although a number of the iApps7 apps identified by Symantec are no longer available in the market, the free app which is there for wallpaper animation includes the note that
The developer page for iApps7 linked on the app's page is invalid.
Another app that Symantec warns about, called "Deal or BE Millionaire" from Ogre Games, includes the note that it
Speaking to Computerworld, Kevin Haley of Symantec said the three publishers "don't appear to be real publishers … These aren't rebundled apps, as we've seen so many times before." Rebundling often occurs when apps produced by reputable publishers are copied and then re-uploaded to the market by smaller publishers or by individuals as though they created them. Such copying is a persistent problem in the Android Market, where there is no pre-approval for apps, although Google can remove them from the official market if there is a complaint or security problem.
Lookout Mobile said "the average Android user probably doesn't want applications that contain Apperhand on his or her phone" but adds that "we see no evidence of outright malicious behaviour". The company argues that "almost all of the capabilities attributed to these applications are also attributable to a class of more aggressive ad networks – this includes placing search icons on to the mobile desktop and pushing advertisements through the notifications bar".
Android allows apps where the user has given authorisation to push apps into its system-wide notification bar. Such authorisation is given when the app is first installed, and will be part of the "permissions" statement that the app requests.
But for Symantec, Haley suggests that few people check or query the permissions an app requests before granting it access to them. "If you were the suspicious type, you might wonder why they're asking for permission to modify the browser or transmit GPS coordinates," he told Computerworld. "But most people don't bother."
Google is trying to make apps' requirements for permissions clearer in the latest version of Android, 4.0. But it is often difficult to know why an app might require access to elements such as USB storage, phone numbers or other details. Users cannot allow or deny apps permission on an element-by-element basis; they can only reject or accept the entire app.
"Adware" has been a persistent problem on desktop PCs, with a number of advertising networks using affiliate schemes in which intermediaries were paid per installation – leading to situations where the software would be installed either through malware on websites, or with installation permission bundled into licence agreements for other software with the details buried in small print. Sometimes the adware would change browser settings or put up intrusive adverts. In the US, the Federal Trade Commission (FTC) won a settlement worth $3m against adware company Zango in 2006.
Symantec said that "multiple publisher IDs on the Android Market … are being used to push out Android.Counterclank", which is software that it says is "a bot-like threat" which can also steal information from devices.
But Lookout Mobile Security, which specialises in mobile and the Android sector, disagrees: "We disagree with the assessment that this is malware, although we do believe that the Apperhand SDK [contained in the apps] is an aggressive form of ad network and should be taken seriously."
The dispute indicates that the conflict about the difference between malware and "adware" – where software on the user's computer generates intrusive advertising – has shifted from the desktop, where the line has been blurred over the years, to the mobile platform, and particularly to Android, the mobile operating system which increasingly dominates world sales of smartphones.
At the same time, it reinforces concerns that Android has become the target for malware writers who find its open market system, as well as the multiple unofficial Android app markets, an effective way to spread malicious software. Both Symantec and Lookout Mobile offer free apps to protect smartphones against malware – which is an increasing threat: another security company, McAfee, noted in a report in November (PDF) that in the third quarter of 2011 "Android became the exclusive target for all new mobile malware", noting that while Nokia's Symbian has the largest total – due to its broad installed base – the number of separate Android malware threats had grown from fewer than 20 new appearances in the third quarter of 2010 to nearly 100 in the same period in 2011. No report has been issued yet for the fourth quarter of the year.
At issue in the dispute between Symantec and Lookout Mobile are apps apparently from three publishers – iApps7, Ogre Games and redmicapps, where Symantec has identified 13 apps that it thinks pose a threat. Symantec said the "Counterclank" malware contained in the games is a variant of "Tonclank", which it first identified on 10 June 2011 and said "may open a back door and download files onto Android devices … [and] steals information from Android devices." Counterclank could push "unwanted ads" to devices and steal browser history, bookmarklets, account details, settings, phone number and other information. It can send that information to apperhand.com – a site whose owner details are hidden and whose home page provides nothing except the phrase "Hello World!".
None of the publishers appears to have its own site, though that is not required to publish to any app store. But the lack of a company supporting the apps could raise suspicions about how bona fide they are.
Although a number of the iApps7 apps identified by Symantec are no longer available in the market, the free app which is there for wallpaper animation includes the note that
"We want to keep this app completely free. In order to keep the app 100% free, you will receive the following –
• Search shortcut icon on your home screen.
• Search shortcut on your bookmarks.
This will help us bring you more cool apps like this in the future."
The developer page for iApps7 linked on the app's page is invalid.
Another app that Symantec warns about, called "Deal or BE Millionaire" from Ogre Games, includes the note that it
"Allows the application to access the phone features of the device. An application with this permission can determine the phone number and serial number of this phone, whether a call is active, the number that call is connected to and the like."It is not explained why an app that appears to use the format of the TV game show "Deal or No Deal" should need to know what number you may be calling.
Speaking to Computerworld, Kevin Haley of Symantec said the three publishers "don't appear to be real publishers … These aren't rebundled apps, as we've seen so many times before." Rebundling often occurs when apps produced by reputable publishers are copied and then re-uploaded to the market by smaller publishers or by individuals as though they created them. Such copying is a persistent problem in the Android Market, where there is no pre-approval for apps, although Google can remove them from the official market if there is a complaint or security problem.
Lookout Mobile said "the average Android user probably doesn't want applications that contain Apperhand on his or her phone" but adds that "we see no evidence of outright malicious behaviour". The company argues that "almost all of the capabilities attributed to these applications are also attributable to a class of more aggressive ad networks – this includes placing search icons on to the mobile desktop and pushing advertisements through the notifications bar".
Android allows apps where the user has given authorisation to push apps into its system-wide notification bar. Such authorisation is given when the app is first installed, and will be part of the "permissions" statement that the app requests.
But for Symantec, Haley suggests that few people check or query the permissions an app requests before granting it access to them. "If you were the suspicious type, you might wonder why they're asking for permission to modify the browser or transmit GPS coordinates," he told Computerworld. "But most people don't bother."
Google is trying to make apps' requirements for permissions clearer in the latest version of Android, 4.0. But it is often difficult to know why an app might require access to elements such as USB storage, phone numbers or other details. Users cannot allow or deny apps permission on an element-by-element basis; they can only reject or accept the entire app.
"Adware" has been a persistent problem on desktop PCs, with a number of advertising networks using affiliate schemes in which intermediaries were paid per installation – leading to situations where the software would be installed either through malware on websites, or with installation permission bundled into licence agreements for other software with the details buried in small print. Sometimes the adware would change browser settings or put up intrusive adverts. In the US, the Federal Trade Commission (FTC) won a settlement worth $3m against adware company Zango in 2006.
