Google won't pull Android apps deemed malicious

Share this article:

A security firm is trying to call attention to 13 applications that have showed up in the official Android Market over concerns that they contain software development tools that enable the theft of data.

The baker's dozen of applications -- carrying names like Counter Elite Force and Balloon Game -- allows downloaders to play action, adventure and puzzle games, Kevin Haley, director of Symantec Security Response, told SCMagazine.com on Tuesday. But they also contain a software development kit (SDK), known as "Appherhand," that not only installs a search bar on the user's phone but also allows the distributors to change the user's home page and add and remove bookmarks and shortcuts, Haley said.

"I'm not sure why you would need to pull someone's bookmarks," Haley said. "I'm not aware of the benefit."

The apps, which contain a trojan dubbed by Symantec as "Counterclank," have been downloaded between one and five million times, Haley said.

Apperhand is quite similar to an SDK that was present in a number of apps that appeared over the summer in the Android Market. They carried malicious code referred to as "Plankton," which enabled the distributor to gain remote access to the device. Ultimately, Google temporarily suspended these apps, but upon conclusion of its investigation, determined that they were not harmful.

"You should be aware what you're getting into when you download these apps, and if you don't want them taking these actions on your phone, then I think you should remove them," Haley said.

Google, however, will not remove the apps because they do not violate its terms of service, Symantec said in a blog post Monday. Reached by SCMagazine.com on Tuesday, a Google spokesman declined to discuss the matter on the record.

Lookout Mobile Security, meanwhile, said in a blog post Friday that it doesn't consider the applications malware, but it does appear to be "an aggresive form of [an] ad network and should be taken seriously."

As the mobile device space continues to mature, security companies and platform providers will be forced to sort out exactly what is worth flagging -- and what is not. Haley likened this to the early days of the PC industry, when spyware programs routinely were considered innocuous.

"Maybe we don't have all the nomenclature set yet in the Android or malware space," Haley admitted. "We're building consensus on what these things ought to be called."

Share this article:

Sign up to our newsletters

More in News

Carbon Grabber crimeware kit being distributed in spam campaign

A spam campaign involving the Carbon Grabber crimeware kit is ongoing against the automotive industry in Europe, according to Symantec.

Errors in ZeroLocker means paying ransom may not decrypt files

A piece of ransomware known as ZeroLocker contains various errors that may prevent files from being decrypted even if the ransom is paid.

Rogue AV scammers find success with new tatics

Although the number of rogue anti-virus malware campaigns have decreased overall, the threat isn't totally gone, according to researchers at Microsoft.