The last few days haven't been very good for Google. It turns out that there have been 58 apps downloaded to about 260,000 devices identified in the Android Marketplace to contain Malicious Software. These aren't just harmless, or low threat apps, but some serious stuff. The Malware is called DroidDream and contains exploit code that can root a user’s device and send the user's data to a remote server. Android Police also found that there is another APK hidden inside the code, which can steal additional sensitive data. They have called this, "The Mother of all Android Malware". My Lookout does a great job of explaining how this code is set up to exploit data on the phone. Google posted on it's mobile blog "If your device has been affected, you will receive an email from android-market-support@google.com over the next 72 hours. You will also receive a notification on your device that “Android Market Security Tool March 2011” has been installed. You may also receive notification(s) on your device that an application has been removed."
Who is affected?
My Lookout has provided a list of the apps that contain the malicious code. If you have downloaded these apps from the market, and haven't received an email from Google, you might want to email them!
My thoughts?
Google's "open" platform is appealing to me on a lot of levels. In fact, I get totally frustrated with Apple's approach of putting everything under their thumb in their app store. But for Google to allow these apps in their own Market is a major fail. If this would have been some unofficial place to get Android Apps, this would have been bad . . . But this was through Google's own Market.
Buds who Blog