Symantec have identified a possible string of botnet Android apps

[mercurial]

Despite a point of contention over the true nature of these applications, a string of 13 apps have been identified as potential threats on the Android Market.

One of the largest security software makers in the business, Symantec (best known for the Norton security software family) say they’ve identified these applications and relate them to a botnet-like virus called Android.Tonclank.

The applications in question run a type of malware called Android.Counterclank. Botnets spread from a host ‘command’ computer and take control of other device via means of spam messages or in this case, malicious applications.

Symantec already say millions of users could be affected and they consider the damage level to be “medium” with regards to data and identification theft. So far a list of 13 applications have been identified on the Android Market as malicious, with the majority of them being mobile games of some form.

Mobile security firm Lookout Mobile don’t believe these applications pose quite as much of a threat however, they are not to be taken lightly, as a spokesperson explains.

“Some companies are calling this a botnet or malware. Lookout has some concerns about the functionality, however at this time, and as far as we can tell, it does not meet the standard to be classified as malware or a ‘bot. Consumers should take these apps very seriously as they appear to tread on privacy lines, but they are not necessarily malicious.”

The company estimated that last year criminals made around $1 million by exploiting Android devices and say its likely to get worse in 2012. Last year Lookout identified a similar botnet string called Geinimi which originated from China. The malware had the ability to take commands from a remote server, steal information from your device and could potentially infect other connected devices too.

The most likely applications to harbour these technological nasties predominantly come in the form of mobile games or porn/adult applications as demonstrated in the list above.

Source

 

[Elimentals]

HAHAHAHAHAHAHAHAHAHAHAHA!!!!!

Latest Android Malware scare might be premature

The folks at Symantec have tipped everyone off about a new piece of Android Malware, calling Android.Counterclank "a bot-like threat that can receive commands to carry out certain actions, as well as steal information from the device." They note that starting one of the apps "infected" with the apperhand SDK package will show a second service running, and often places a search icon on the home screen. They have verified this is in 13 applications on the Android Market and are calling it "the highest distribution of any malware identified so far this year." Some reports on the internet claim it may have affected 5 million users. That's 5,000,000 -- a huge and scary number. And it makes for a great headline.

But it looks like Symantec might have jumped the gun a bit.

Lookout, a competitor in the Android security field, says that the applications are not malware, and the apperhand package actually is a legitimate, but aggressive, advertisement component. It's part of an advertising software development kit that's a modified version of the "ChoopCheec" platform” or “Plankton” SDK that was the focus of some privacy concerns in June 2011. This newer version is cleaner, but it still has capabilities common to many ad networks. Writes Lookout:

• It is capable of identifying the user uniquely by their IMEI number, for instance. But unlike some networks, this SDK forward-hashes the IMEI before sending to its server. They’re identifying your device, but they are obfuscating the raw data. (That's a good thing.)
• The SDK has the capability to deliver “Push Notification” ads to the user. We’re not huge fans of push notifications, but we also don’t consider push notification advertising to be malware.
• The SDK drops a search icon onto the desktop. Again, we consider bad form, though we don’t consider this a smoking gun for malware provided the content that is delivered is safe. In this case, it is simply a link to a search engine.
• The SDK also has the capability to push bookmarks to the browser. In our opinion, this is crosses a line; although we do not believe this is cause to classify the SDK as malware.

We're not sure exactly how far is too far, but if the applications are using practices found in "many" other ad networks, we agree with Lookouts points listed here and have to call this one a non-issue when talking about malware. On the issue of privacy and wanton sharing of user data, we're not loving it, but it's not malware.

We're not security specialists, and we never claim to be. We can tear applications apart and see what's hiding in there, but in-depth scanning and analysis is best left to the experts. That being said, we are experts at catching bull****, and this one reeks of it. Nobody likes ads, but we can't just call them malware anytime we like. They're a part of the ad-supported app model, and we should expect to see more than we like. When they misbehave, call for someone's head, but not before.

But that's not sensational. Headlines like Computerworld's "Massive Android malware op may have infected 5 million users" cause controversy, and everyone loves a controversy. Explaining that the 5 million mark is from adding the high end of the download counters, which allows for a 4 million-device margin of error, is conveniently forgotten. And we'd like to think that if as many as 1 million devices on the low end had been infected, Google and the Android Market team would have said something.

The long and the short of it is, we're sleeping just fine tonight. Move along.

Source: Android Central

I very much suspect they had something like this:

In Symantec Meeting Room, B:

Exec 1: Crap, so how do we divert the attention away from us?
Exec 2: Whattayamean?
Exec 1: You know, our servers getting hacked? Source Code getting released? You know? People finding out that our software is basically...
Exec 2: Alright, alright, I get it.
Exec 3: Hey, we have a report from our mobile engineering team.
Exec 2: And?
Exec 3: They found some apps on Android that pushes notification and puts shortcuts on the users home screen without permission.
Exec 1: Good enough, call it malware. How many people are using Android?
Exec 4: 20 million, give or take a few?
Exec 2: Ok, say 5 million are affected.
Exec 4: Ok, I'll have the engineer write a scary sounding presser on it.
Exec 2: OK. That's good. What time is it? Do I have to be at my gym in the next 25 minutes?

 

[shamalh108]

Lmao! That's exactly what happened, honestly look at those apps, if you download that you asking for trouble.. besides, unless you side load apps like a mad man from any site, you won't get a virus, simple

 

[Elimentals]

LOL Told you so:

Last week, we posted a blog informing Android users of the discovery of new versions of Android.Tonclank, which we have named Android.Counterclank. The blog generated a bit of discussion over whether these new versions should be a concern to Android users. When classifying applications, our focus is on whether users want to be informed of the application's behavior, allowing them to make a more informed choice regarding whether to install it.

The situation we find ourselves in is similar to when Adware, Spyware, and Potentially Unwanted Applications first made appearances on Windows. Many security vendors did not initially detect these applications, but eventually, and with the universal approval of computer users, security companies chose to notify users of these types of applications.

Since our initial blog post, we have determined the code in the Tonclank and Counterclank applications comes from the same vendor. The vendor is a company who distributes a SDK (software development kit) to third parties to help them monetize their applications, primarily through search.

In particular, the SDK code will connect to a remote server (apperhand.com) and send the following information:

A SHA1 hash of device information (such as IMEI) to uniquely identify the installation
Information to identify the application using the SDK
Device information such as the brand, manufacturer, model, and Android OS version
Display metrics such as screen size and resolution
Language preference
Browser user agent

After receiving this information, the code will wait for a command. Commands of interest include:

ACTIVATION – Causes a webpage to be displayed. The feature appears to be designed to display a webpage with a EULA (end-user license agreement), but our testing was unable to reproduce applications showing such a page.

HOMEPAGE – Sets the browser’s homepage.

BOOKMARKS – Create or request bookmarks. In our testing, we have seen this feature actively used to send all the bookmarks of a device to apperhand.com

SHORTCUTS – Create shortcuts on the home screen.

The homepage, bookmarks, and shortcuts may be sent to the following domain:
http://searchwebmobile.com/search?sourceid=1&app=[UNIQUE APPLICATION ID]

Searchwebmobile.com belongs to a third party, Infospace, who provides monetary compensation to applications redirecting search queries through their website.

Additional commands also exist, but do not have direct security and privacy implications. Further, different versions of the SDK have been created with new commands which have not been fully examined. The analyzed applications did not provide in-app notification of these behaviors and the bookmarks, shortcuts, and homepage modifications do not specify the application behind the change or the responsible company. The SDK provider's website does state they require application developers to place a notification in the Android Market description noting that the application will modify the homepage, create a bookmark, and create a shortcut to a search site. Those notifications did not include information on the exfiltration of bookmarks.

Due to the combined behavior of the applications, negative feedback from users who installed the applications, and the fact that previous applications (Android.Tonclank) using this code were initially suspended from the Google Market, we chose to notify users of Counterclank.

We have also submitted a ticket to Google for the removal of Counterclank from the Android Market. Google replied quickly informing us the applications met their Terms of Service and they will not be removed. We expect in the future there may be many similar situations where we will inform users about an application, but the application will remain in the Google Android Market.

We are also in discussions with the SDK provider and hope to provide feedback which helps ensure mobile users have the necessary details to make informed choices.

The mobile ecosystem is growing rapidly and many monetization paradigms are being explored. At Symantec, we follow these developments closely while actively developing new technologies to cater to the variety of applications available and the differences in users' preferences and tolerances for certain behaviors. Through such technology, we hope to avoid the pitfalls of labels such as malicious, spyware, and adware, and instead provide methods to automatically inform users of undesired applications based on their personal preferences. We hope this future technology will encourage a vibrant mobile ecosystem and, at the same time, keeps users safe.

Source Symantec

OEM's/Google should sue the basterds for false claims and scaremongering.... maybe next time they would think twice before running around crying wolf.

Crapware is not malware

 

[Maverick Jester]

The start of this thread had me worried that Symantec had developed a level of competency. Seems that all is still right in the world then

 

[murraybiscuit]

crikey. i'd better rush out and get an expensive bloatware antivirus for my android phone now.
i'd better get one from symantec, they just picked up a bunch of viruses on android and we all know they are safe as houses...
/sarcasm

 

[grok]

Anyone still using Symantic deserve to be infected.
That is all.

 

[Elimentals]

Anyone still using Symantic deserve to be infected.
That is all.

Its actually sad to see what they became.

I remember using PC tools back in the Norton/Dos days and they where a well respected company.

 

[mercurial]

Anyone still using Symantic deserve to be infected.
That is all.