Google Pulls 500+ Backdoored Apps With Over 100 Million Downloads From Google Play (helpnetsecurity.com) 58
Orome1 shares a report from Help Net Security: Security researchers have identified over 500 apps on Google Play containing an advertising software development kit (SDK) called Igexin, which allowed covert download of spying plugins. The apps in question represent a wide selection of photo editors, Internet radio and travel apps, educational, health and fitness apps, weather apps, and so on, and were downloaded over 100 million times across the Android ecosystem. Lookout researchers did not name the apps that were found using the malicious SDK, but notified Google of the problem. The latter then proceeded to clean up house, either by removing the offending apps altogether, or by forcing app developers to upload an updated version with the invasive features (i.e.
the Igexin SDK) removed. "Users and app developers have no control over what will be executed on a device after the remote API request is made. The only limitations on what could potentially be run are imposed by the Android permissions system," the researchers pointed out. "It is becoming increasingly common for innovative malware authors to attempt to evade detection by submitting innocuous apps to trusted app stores, then at a later time, downloading malicious code from a remote server. Igexin is somewhat unique because the app developers themselves are not creating the malicious functionality -- nor are they in control or even aware of the malicious payload that may subsequently execute. Instead, the invasive activity initiates from an Igexin-controlled server."
List (Score:5, Insightful)
What's the point of source material that doesn't include a list of the apps?
Re:List (Score:5, Insightful)
I agree. Without the list of impacted applications, this "warning" is pretty worthless and more of a PR piece.
Re:List (Score:4, Interesting)
Not a ideal solution. You might have data and whatnot on these apps.
Also, doing it automatically makes Google look like Microsoft and their Windows 10 updates. I guess it's just not good PR.
Re: (Score:3)
Re: (Score:3)
Re:List (Score:5, Informative)
What's the point of source material that doesn't include a list of the apps?
According to the Ars Technica [arstechnica.com] article, the researchers say they didn't publish a list of the apps to avoid punishing app developers who didn't realize that the Igexin SDK could download and execute plugins which could potentially exfiltrate user data that the app had permission to see.
Re:List (Score:5, Insightful)
Translation:" Big, BIG Brand apps were also affected and we don't want to end up on their shit lists."
Re: (Score:1)
The XcodeGhost is malicious and the public is made aware with the list of affected apps. I would say this lgexin would not be that much different from the iOS debacle. At the very least, the apps should be revealed later after the publishers (at least those who were given a chance) had fixed the issue, similar to how security holes and exploits are properly publicized. Those who do not fix it in time must be outed as well to prevent further abuse by the developers of the SDK.
Re:List (Score:4, Insightful)
Not only should a list of the "Apps" be provided, so should a list of the "Developers" who used this SDK. Let's run this down, shall we?
The Igexin SDK is Adware. "Developers" use it to generate extra income by letting Third Parties deliver Ads within the App. They have the ethics of an Alley-Cat; they don't care what the Ads are for, or assume any responsibility for them.
They are too stupid, too lazy, or too venal to care. (This is true for anybody who lets Third Party Advertising through. If they don't care to Host or Vet this crap, screw them.)
All Adware is Malware these days by definition. Top bad, it didn't have to be this way. Also note how delicately wording is being used here. The Apps, the Developers, the Igexin Touts being discussed here are all Chinese Nationals. This is one that can't be blamed on the Russians.
This is not a knock against the Chinese. If this proves to be an embarrassment enough, China has the will and the means to Disappear those involved.
So let's see the list of the Apps, and the list of the Names.
This is the kind of information that needs to be free. For the Embarrassment.
So why aren't these Apps named? (Score:4, Insightful)
... IMHO these Apps should be named ...
Re: (Score:3, Insightful)
Better yet. Google should present us with an App that verifies if any of them are currently on our devices and offer to remove them.
Simply pulling from the store amounts to little more than sweeping the problem under the rug.
Re: (Score:3)
Better yet. Google should present us with an App that verifies if any of them are currently on our devices and offer to remove them.
Simply pulling from the store amounts to little more than sweeping the problem under the rug.
Don't forget the refund if they're non-free apps.
Re: (Score:2)
Re:So why aren't these Apps named? (Score:4, Informative)
Wow (Score:2, Insightful)
FFS Google, how did you let it get this bad? I thought that you were supposed to be watching out for this kind of stuff. We need a "Install apps from the Google Play Store" toggle in the next version of Android. Default: OFF.
Oreo makes "Unknown sources" per-app (Score:2)
Android 8 "Oreo" has moved "Install apps from unknown sources" from a system-wide setting to a finer-grained permission for each app [googleblog.com]. This means F-Droid users won't need to put the whole operating system's shields down anymore. So if you have Oreo, and you don't download from Google Play Store, and you "Uninstall updates/Disable" any carrier-installed crap that's not part of AOSP or other core functionality, then you sacrifice a few genres of apps [pineight.com] but gain the theoretical safety of publicly auditable softwa
Re: (Score:2, Funny)
Outraged (Score:2)
Only Google's homegrown spyware is allowed on my phone! None of this third-party spyware for me.
If anyone is interested in what Igexin says... (Score:5, Interesting)
Bullshit, SDK's should not "hot-fix" (Score:3, Insightful)
Possible nefarious behavior aside, this behavior is unacceptable in an "SDK". The developer/development team that created the application developed against a specific version of the SDK and tested against that. If an SDK hot-fixes, you've completely invalidated the testing for that application and possibly broken things in the application. Even if the only thing you're doing is fixing known bugs in the SDK, it's quite possible that the developers implemented code to work around those bugs and fixing it w
Well... (Score:3)
...mightn't it be useful somewhere to list the apps that were pulled, and or their authors?
Android itself is a security flaw (Score:2)
So they once have flaws in their walled garden store that allow malware on to people's devices, then don't even tell them which ones they were. They have had flaws in the past, and who knows how many more are yet to be discovered.
While they do monthly "security updates" less than 1% of users actually get them in a timely manner most will never get them at all and you can forget about large OS updates.
One of these days some horrible malware is going to hit most of their users and once that happens, it will
Re: (Score:2)
Android's security model is more robust than iOS's. However, the issue is how things are curated. Apple is a brutal and capricious caretaker, while Google is reactive.
A reactive security model is more robust than a proactive one?
Especially one that doesn't notify the victims of the malware which apps are screwing their pooch.
Re: (Score:1)
Google is already working on changes to their update mechanisms for Android (and Android's successor OS test builds) that cut out the cause of delayed/non-existent updates entirely: Wireless companies like Verizon.
Comment removed (Score:5, Insightful)
Re: (Score:2)
The system has worked and the problem is rendered safe. Many developers would not have known what this code does as it is part of a 3rd party SDK. There's as much sense in identifying this malware as there is posting the names of people who's computers were hit by Petya
Re: (Score:2)
Re: (Score:2)
These developers used a sketchy malware-laden "monetization" package without bothering to find out what it really does. Now that they can't use this sketchy malware-laden "monetization" package, they're going to have to quickly integrate some other sketchy malware-laden "monetization" package to keep the money rolling in. They will reoffend and not identifying them facilitates this.
Google's future? (Score:1)
These apps are downloaded over 100 million times and Google just takes action now. I think that says some thing negative about Google and how they do business. I hope Google will be more responsible in the future. Are there legal uses for the Igexin SDK?
Re: Google's future? (Score:2, Informative)
Lgexin was a legitimate ad network at one point, but it contained an update mechanism which could be abused later (and downloading malicious components later was one way to evade Google's malware scanners). The apps are being removed/updated to prevent future abuse, not only to stop current abuse; The list of affected app is being witheld because not all of the apps/developers were malcious.
Re: (Score:2)
But what about the user who wants to swab his or her throbbing anus to see if the macro-penis assailant was microbiologically weaponized?
We need a list.
Aren't you being way too concerned about the wrong side of this?
Doesn't matter (Score:5, Interesting)
It's probably a good time (Score:2)
For google play to get a whole lot more serious about application security checks before allowing them to become available.
The play store should be held (financially/legally) responsible when issues like this occur.