Google won't pull Android apps deemed malicious

Share this article:

A security firm is trying to call attention to 13 applications that have showed up in the official Android Market over concerns that they contain software development tools that enable the theft of data.

The baker's dozen of applications -- carrying names like Counter Elite Force and Balloon Game -- allows downloaders to play action, adventure and puzzle games, Kevin Haley, director of Symantec Security Response, told on Tuesday. But they also contain a software development kit (SDK), known as "Appherhand," that not only installs a search bar on the user's phone but also allows the distributors to change the user's home page and add and remove bookmarks and shortcuts, Haley said.

"I'm not sure why you would need to pull someone's bookmarks," Haley said. "I'm not aware of the benefit."

The apps, which contain a trojan dubbed by Symantec as "Counterclank," have been downloaded between one and five million times, Haley said.

Apperhand is quite similar to an SDK that was present in a number of apps that appeared over the summer in the Android Market. They carried malicious code referred to as "Plankton," which enabled the distributor to gain remote access to the device. Ultimately, Google temporarily suspended these apps, but upon conclusion of its investigation, determined that they were not harmful.

"You should be aware what you're getting into when you download these apps, and if you don't want them taking these actions on your phone, then I think you should remove them," Haley said.

Google, however, will not remove the apps because they do not violate its terms of service, Symantec said in a blog post Monday. Reached by on Tuesday, a Google spokesman declined to discuss the matter on the record.

Lookout Mobile Security, meanwhile, said in a blog post Friday that it doesn't consider the applications malware, but it does appear to be "an aggresive form of [an] ad network and should be taken seriously."

As the mobile device space continues to mature, security companies and platform providers will be forced to sort out exactly what is worth flagging -- and what is not. Haley likened this to the early days of the PC industry, when spyware programs routinely were considered innocuous.

"Maybe we don't have all the nomenclature set yet in the Android or malware space," Haley admitted. "We're building consensus on what these things ought to be called."

Share this article:

Sign up to our newsletters

More in News

Firefox 31 plugs critical memory safety bugs

In total, Firefox 31 brings 11 patches for several flaws affecting the web browser.

Android/Simplocker adds tricks, including ransom message in English

Android/Simplocker ransomware now encrypts archive files, asks to be installed as a Device Administrator, and delivers an English-language ransom message.

Wall Street Journal website vulnerable to SQL injection, gets hacked

The Wall Street Journal confirmed on Tuesday that an outside party exploited a vulnerability and hacked into its new graphics systems.