Google throws 'kill switch' on Android phones

For only the second time, Google last weekend remotely deleted Android apps from users' phones.

Google made the move to erase malware-infected applications that users had downloaded from the Android Market, the company's official e-store.

Last Wednesday, Google removed more than 50 infected apps published by three different developers from its marketplace, but didn't trigger automatic uninstalls until several days later.

In many cases, the malicious apps were bogus versions of legitimate programs that had been recompiled to include malware, or as a Symantec researcher said last week, "Trojanized."

According to San Francisco-based smartphone security firm Lookout, between 50,000 and 200,000 copies of the apps were downloaded by users before Google yanked them from the Android Market.

Google has thrown the Android app "kill switch" only once before: In June 2010, it yanked a pair of apps it said were published by a security researcher, who "intentionally misrepresented their purpose in order to encourage user downloads."

In that case, however, the apps were not designed to be used maliciously, and did not request permission to access private data.

According to Lookout, which has been analyzing the infected apps since last week, the recently-pulled-and-uninstalled apps not only demanded extended permissions, but also made off with a wide range of information from the infected phones. Among the data pulled by the infected apps: the phone's IMSI (International Mobile Subscriber Identity) and IMEI (International Mobile Equipment Identity) numbers, unique identifiers of the subscriber and smartphone.

After one of the infected apps is downloaded and installed, the phone also surreptitiously downloads a second-stage with "one or two root exploits," said Kevin Mahaffey, the CTO of Lookout, that give attackers complete control of the device.

"I don't know if the hackers were joking when they named [the malware] DroidDream, but the second-stage only downloads between 11 p.m. and 8 a.m., when most users are asleep," said Mahaffey. He speculated that the timing was to insure users didn't notice any unexplained network activity while that stage was downloaded.

Besides pulling the kill switch, Google is also pushing an app of its own, dubbed "Android Market Security Tool March 2011," to all affected Android phones, said Rich Cannings, the head of Android's security team, in a blog post Sunday.

That app, which will be installed automatically no later than Tuesday on all Android phones whose owners had downloaded one or more of the malicious apps, prevents attackers from accessing any additional information by undoing the root access the malware obtained by exploiting vulnerabilities.

The Android Market Security Tool March 2011 does not patch the underlying bugs that were exploited by the malware-infected apps, said Mahaffey, but does appear to remove traces of the malicious code that aren't erased when the apps are uninstalled. Lookout is continuing to dig into Google's tool for more insight into its workings.

According to Google, Android 2.2.2 and earlier contains the bug, but later versions, including Android 2.3, aka "Gingerbread," do not.

Unlike Apple, Google does not distribute its own mobile operating system updates, whether security-related or otherwise, but relies on carriers to do so. Google launched Android 2.3 in December 2010, but as of mid-February, the bulk of Android phones -- nearly 90 per cent by Google's numbers -- were still running older, and thus vulnerable, versions of the operating system because carriers often take months to roll out Android updates.

Analysts have also blamed Google's lax app publishing policy for allowing the infected software onto the Android Marketplace.

"Google will change its model," said John Pescatore, a security analyst with Gartner Research, referring to Google's current practice of not vetting the apps listed in the market. In contrast, Apple closely reviews all apps that it places in its App Store, which is also the only sanctioned outlet for the iPhone.

"Google's search engine tells users when it suspects a site might be distributing malware," Pescatore noted. "That's what the market wants in a search engine and in mobile. People don't want to say, 'Oh oh, should I download this app?' They just want to say, 'That's a cool app, I'll download it.'"

Pescatore also knocked Google for resorting to pushing the security tool to users after the fact. "That's the worst of both worlds, if Google says 'We'll continue to let anything in the Market, but then says, 'Download this [anti-malware] app,'" said Pescatore. "Don't force us back to the bad ways of the PC.

"It's so much better to keep the bad stuff off in the first place," Pescatore said. "Come on, Google."

Mahaffey, however, applauded Google's decision to automatically install the tool. "Hats off to Google," he said today.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed. His e-mail address is gkeizer@computerworld.com.

Read more about security in Computerworld's Security Topic Center.

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

• Bookmark this page
• Share this article
  •  
  • facebook
  • slashdot
  • digg
  • Reddit
  • stumbleupon
  • linkedin
  • twitter
• Got more on this story? Email CIO
• Follow CIO on twitter

• Share
  Share this article

  •  google+
  • facebookfacebook
  • slashdotslashdot
  • diggdigg
  • RedditReddit
  • stumbleuponstumbleupon
  • linkedinlinkedin
  • twittertwitter
• print
• email
• Bookmark