Jason Steer Veracode
The inevitable has happened. 2011 has become the year of mobile malware. All the pieces of the malware ecosystem puzzle that researchers have been warning about are falling into place:
The malicious apps that were pulled were legitimate apps that had been pirated, modified by the attackers, and republished. To downloaders of these apps they behaved and looked like well-functioning ones. There was no reason for these users to rate these apps poorly in the Android Marketplace's reputation system or to leave comments that the apps were suspicious. This shows that reputation systems are a poor method of ensuring an app store is free of malware.
To Google's credit they did remove the apps and have, or will, wipe the apps from users' devices but this is too little, too late. The mobile devices are already compromised as the malware took advantage of kernel vulnerabilities to root the devices and download more malware that didn't come through the app store. Anyone who ran the malicious apps now has a compromised device running software with root permissions that Google cannot wipe.
The exact same thing could happen tomorrow even though we know what Android kernel exploit code was used and there are new versions of Android that fix these issues. This is because many Android phones cannot be updated to the new versions of Android, 2.2.2 and 2.3, that fix the root holes. Many Android phone providers have customized their versions of Android so up to half of Android phones running 2.0, 2.1, 2.2 are sitting ducks to the same problem tomorrow.
There are two problems that need fixing because we can't fix the attacker motivation piece of the puzzle:
