Today, Lookout is reporting that they have found a new family of malware that has been running rampant throughout Google Play called, BadNews. BadNews was found on a total of 32 applications on Google Play and through statistics, is said to have been downloaded roughly 2 million to 9 million times. 

Lookout brought this to the attention of Google and the company immediately removed the infected apps and have suspended the developer accounts associated with them.

BadNews masquerades as an innocent, if somewhat aggressive advertising network. However, it has the ability to send fake news messages, prompt users to install applications and sends sensitive information such as the phone number and device ID to its Command and Control (C&C) server. BadNews uses its ability to display fake news messages in order to push out other types of monetization malware and promote affiliated apps.

During our investigation we caught BadNews pushing AlphaSMS, well known premium rate SMS fraud malware, to infected devices.

Naturally, users who currently have the Lookout application installed on their device are safe from this threat.

Via: Lookout

Lookout Discovers New BadNews Malware Family, Infected 32 Different Apps on Google Play is a post from: Droid Life

Depending on who you talk to, Android as an operating system may or may not have an issue with malware, spyware and viruses. We typically operate under the idea that it in no way has a problem, but that there are plenty of security companies out there willing to tell you otherwise. To be fair, though, there have been cases of malware or viruses in Android apps, most simply aren’t found anywhere near the Google Play store. If they are found, it’s usually through alternative 3rd party markets or pirated apps. 

To keep you safe and to help ease your mind, just in case you are worried about potential threats, there is no harm in installing apps that are built to protect you. And trust me, there are plenty out there. In fact, all of your favorite security companies have Android apps that will scan the heck out of your phone, while trying to find something malicious.

Instructions:

1.  Once installed and you have walked through setup, scanning for viruses is incredibly simple.
2.  Tap the “Virus Scanner” button.
3.  Then decide if you want to scan apps only or your SD card too.
4.  At this point, you can also set up a schedule to have your phone scanned regularly.
5.  Press “Scan now” and off you go.
6.  If your phone finds anything wrong, it will notify you and also give you instructions to fix.

Scanning is a pretty easy task to complete that I’m sure most of you will have no problem with. What you’ll need to decide, is which app you like the most depending on its feature set. Almost all of the security apps listed below will help if your phone is lost or stolen, they’ll scan your phone for viruses,  they will monitor app permissions, scan apps before they install or open, and will even see which apps are using the most data.

If you are like us, and think that the anti-virus side of Android isn’t all that frightening, think about using these apps for the other reasons I just listed above. Feel free to check each out, read reviews about them all, run through their list of features, and then decide if one fits your needs.

Play Links:  Avast! | Zoner | Norton | Lookout | Kaspersky ($14.95)

Presented by Norton 360™ Multi-Device. Protect your new computers, smartphones, and tablets with Norton 360™  Multi-Device.

How to: Scan Your Device for Malware or Potential Threats [Beginners' Guide] is a post from: Droid Life

A number of our readers with DROID 3 phones (and one Incredible owner) along with various forums, are reporting that a mysterious app showed up as installed on their phones within the last day or two. At one point the app carried a person’s name, like “Brett Henderson” and “Timothy Milla,” but changed today to “Souper Android Development.” The troubling part of this story is that the app can not be uninstalled, doesn’t even show as an installed app, and no one can explain how it got there in the first place.

We aren’t sure at this time what exactly this app is capable of or if it is in fact malicious, but a name-changing, uninstallable app certainly shouldn’t excite you. Also, as you can tell from the screenshots, our tipster is rooted, so there is a chance this app made it’s way onto his phone by taking advantage of that. However, this seems to be widespread enough that it could have happened through other means and not just on rooted phones. We are still trying to find out if this app made its way onto non-rooted phones. 

In potentially good news though, Google may have flexed their power to remove apps remotely from affected users’ phones. One of our tipsters finally sent over the Play link to this app (which in name references a Motorola Contacts app, aka a system app) and we noticed that it had been removed (or was never there?). So we then asked for him to check his installed apps to see if “Souper Android Development” remained and he confirmed that it is no longer on his phone or at least showing up as an installed app. Talk about confusing.

Update:  After reading more forum posts than any man should across the interwebs, many are suggesting that it could be just a Google Play error and is not anything to worry about. We will update this post should we hear anything back. For now, let’s not assume that this app is malicious. We have also tweaked the title of this post as to not alarm the hell out of everyone.

We have reached out to some contacts to see if we can get additional information.

In the mean time, be sure to drop us a line in the comments if you were or are still affected by this rogue app.

Cheers Audie, Andrew and everyone else!

Mysterious App Called “Souper Android Development” Invades DROID 3 Phones, Google Remotely Removes It? is a post from: Droid Life

As Android is growing across the globe and reports of malware scares reportedly rise, mobile security companies are making sure that consumers are aware and that they would like them to be concerned. To make the situation seem worse, the number of Android apps and daily Android activations are growing by record numbers, so it’s only natural that these reports of malware detection would increase. That’s where we get a new Android security player to review on the daily. 

A company by the name of AV-TEST has taken this growth in Android security apps quite seriously and has published a rather large report on which of them are actually effective and worth your time. After looking at over 40, they were left with the following seven applications, who were the only ones able to catch over 90% of malware loaded onto test devices:

• Lookout Mobile
• Kaspersky
• Avast!
• Dr. Web
• F-Secure
• Zoner Anti-Virus
• IKARUS

The graph below shows the list of all apps used in the tests and the various hit and misses for each app:

See your choice on the top of the list? If not, maybe it’s time to think about switching up security services. As a friendly reminder, you should always install apps from only trusted sources and check the app’s permission list before installing them. Stay safe, folks.

Via: AV-TEST

Cheers Li-Lun!

Over 40 Android Anti-Virus Apps Tested, Only 7 Have Malware Detection Rate of Over 90% is a post from: Droid Life

Moments ago, Google unveiled a security service that has been working behind the scenes on Android for a few months now, codenamed Bouncer. The service allows the Android Market to scan apps that have been uploaded, analyze them for trojans or other malware, and then determine if they have tendencies that would lead them to misbehave. Again, this has been going on for months to protect you, Google is just now letting you know about how successful it has been. 

Here is the full explanation from Google:

The service performs a set of analyses on new applications, applications already in Android Market, and developer accounts. Here’s how it works: once an application is uploaded, the service immediately starts analyzing it for known malware, spyware and trojans. It also looks for behaviors that indicate an application might be misbehaving, and compares it against previously analyzed apps to detect possible red flags. We actually run every application on Google’s cloud infrastructure and simulate how it will run on an Android device to look for hidden, malicious behavior. We also analyze new developer accounts to help prevent malicious and repeat-offending developers from coming back.

Also in this announcement for Bouncer, Google managed to take a shot at the anti-spyware and security companies that you hear from constantly in the Android world. During their testing of this new security service, Android Market stats showed a 40% drop in potentially malicious apps being downloaded during 2011. That comes on the heels of numerous reports from anti-spyware companies that malware is constantly on the rise, something many of us have questioned all along.

Here is the exact quote:

The service has been looking for malicious apps in Market for a while now, and between the first and second halves of 2011, we saw a 40% decrease in the number of potentially-malicious downloads from Android Market. This drop occurred at the same time that companies who market and sell anti-malware and security software have been reporting that malicious applications are on the rise. While it’s not possible to prevent bad people from building malware, the most important measurement is whether those bad applications are being installed from Android Market – and we know the rate is declining significantly.

Lastly, Google wants to make sure you understand how Android works on the security front and that it has been designed to make malware less potent. Some of the security measures include:

• Sandboxing: The Android platform uses a technique called “sandboxing” to put virtual walls between applications and other software on the device. So, if you download a malicious application, it can’t access data on other parts of your phone and its potential harm is drastically limited.
• Permissions: Android provides a permission system to help you understand the capabilities of the apps you install, and manage your own preferences. That way, if you see a game unnecessarily requests permission to send SMS, for example, you don’t need to install it.
• Malware removal: Android is designed to prevent malware from modifying the platform or hiding from you, so it can be easily removed if your device is affected. Android Market also has the capability of remotely removing malware from your phone or tablet, if required.

Feeling safer already?

Via:  Google Mobile

Cheers for the pic MrChips!

Google Introduces “Bouncer” Security Service for Android: Shows Massive Drop in Malicious Downloads, Calls Out Anti-Malware Companies is a post from: Droid Life

If stressing over malware on Android is something that you enjoy on a daily basis, the crew responsible for Lookout Security has a new release that will satisfy your needs. Their newest app titled Mobile Threat Tracker takes the last few day’s security threats that their security products have identified and displays them in a visually stunning, rain shower-ish, globe rotating manner. You can view the top threats, tap to view more info on them, and then decide for yourself if you believe that there is actually a Malware problem in Android. Is there? I’m not ready to buy into yet, but hey, the app looks snazzy.

Market Link

Can’t Live Without a Visual Representation of Android Malware Across the Globe? Lookout has an App for That is a post from: Droid Life

CA Technologies discovered a new type of Android Trojan that drops a “config” file onto your device after being installed that can record phone conversations.  ”ZOMG! The world is coming to an end!”  Yeah, that was extreme sarcasm.  You see, with no major device releases expected this week, we’ve resorted to talking about stories like this.  Stories of random malware/trojans that another security company has discovered in an app from an unknown source that could ruin your day should it get installed.  Of course, you would have to visit another of those shady 3rd party app stores that hawk paid apps for free in order for this to go down, but you already know that.

So what do we make of this?  As we have already mentioned a half dozen times now, AVOID SHADY 3RD PARTY APP STORES.  Support your damn developers in legitimate markets.

Via:  CA, ZDNet

New Android Trojan Can Record Calls, We Remind You Again to Avoid Shady 3rd Party Markets is a post from: Droid Life

GG Tracker is a new Trojan which has recently been discovered by the lovely people over at Lookout. If users are infected by the Trojan, they are directed to an imitation of the Android Market on their mobile, to download a free app. Once it is downloaded it unknowingly goes to work by signing you up for a ton of premium SMS services, and it’s all downhill from there. Lookout has done a very extensive write up on what it is, how it works, and how to avoid it. Tim Wyatt of Lookout writes:

Lookout has identified a new Android Trojan, GGTracker, which is automatically downloaded to a user’s phone after visiting a malicious webpage that imitates the Android Market.  The Trojan is able to sign-up a victim to a number of premium SMS subscription services without the user’s consent.  This can lead to unapproved charges to a victim’s phone bill.

Have you all been browsing bad websites? Let me just say that this issue could seriously be alleviated if we all just took two seconds and make sure that what we’re browsing is such a good idea. If you’re on the Android market’s website, you better see “Android Market” somewhere in the URL. 

Above is an example URL taken from the Lookout blog, where the mobile site imitates the Android Market. The first step in making yourself safer against these things, is honestly being aware of their existence. If you’re proactively making sure you’re visiting safe sites, then this issue hopefully will never affect you. Lookout has their own thoughts on how this is happening to victims;

We believe Android users are shown an advertisement that directs them to a malicious website that resembles the Android Market installation screen.

The website entices a user to click-through to download and install an application (in one case, a fake battery optimizer packaged as t4t.pwower.management, and in another a porn app packaged as com.space.sexypic). If the user clicks the install button, the malicious app will begin to download and dialogue appears to direct the user to install via the download notification.

Once activated, GGTracker registers the victim for premium subscription services that would normally require the user to reply or enter a pin on a webpage. Charges may be up to $9.99.

They list a few ways to protect yourself, one of course is Safe Browsing which is included in Lookout’s app for Premium Users. Others include making sure you’re visiting safe sites, and double checking the URLs you are browsing. We have done readers polls before asking if you were all worried about these things, and from the look of it, this is something a few of you are concerned about. So are you going to be more careful? We all have a choice when it comes to these things, so don’t be afraid to do the research and see if downloading a mobile security app is right for you.

Via: Lookout Blog

New Type Of Android Trojan Charges For Premium SMS Services is a post from: Droid Life

Back in March, a number of potentially dangerous apps were found in the Android Market that had the ability to root your phone and proceed to steal personal information.  What the developer behind them was doing, was looking for some of the more popular apps in the market, downloading and repackaging them with malware, and then uploading them to the market.  They were essentially duplicates that were difficult to spot to the average user.  The group of apps were dubbed “DroidDream” and were thought to be all but wiped out – and this weekend happened.

Our pals over at Lookout Security were tipped to another batch of apps that were posing a similar threat which they are now calling “DroidDreamLight” or DDLight.  Around 34 applications and 6 developers made the list which we have for you below.  I’d suggest that you take a quick look through them all and then browse through the app list on your phone to make sure you are clean.

And I hate that we have to do this, but again, to avoid these types of problems you need to be a little more careful when downloading apps.  If the app has only been downloaded a few times, has a low rating, and is from a developer you have never heard of, you should probably avoid it.  If the app contains the words hot, sex, girls, or breasts you should probably avoid it.  If you are browsing for free “fake” versions of legitimate paid apps because you are a cheap ass, go get a job just know that you are opening yourself up to a bad time.  This isn’t rocket science – only download from reputable developers and you’ll be fine.

The full list of developers and apps is after the break.  

Developer:  Magic Photo Studio

Sexy Girls: Hot Japanese
Sexy Legs
HOT Girls 4
Beauty Breasts
Sex Sound
Sex Sound: Japanese
HOT Girls 1
HOT Girls 2
HOT Girls 3

Developer:  Mango Studio

Floating Image Free
System Monitor
Super StopWatch and Timer
System Info Manager

Developer:  E.T. Tean

Call End Vibrate

Developer:  BeeGoo

Quick Photo Grid
Delete Contacts
Quick Uninstaller
Contact Master
Brightness Settings
Volume Manager
Super Photo Enhance
Super Color Flashlight
Paint Master

Developer:  DroidPlus

Quick Cleaner
Super App Manager
Quick SMS Backup

Developer:  GluMobi

Tetris
Bubble Buster Free
Quick History Eraser
Super Compass and Leveler
Go FallDown !
Solitaire Free
Scientific Calculator
TenDrip

Via:  Lookout

Lookout Identifies Another 34 DroidDream Malware Apps in the Android Market is a post from: Droid Life

There was a lot of talk last week about security on the Android platform after the DroidDream malware scare, but to help ease all of your minds, Google has released a statement detailing all of the steps they are actively taking to make our mobile world a safer place.  We should point out that anyone running anything less than Android 2.2.2 was susceptible, so please read the 4 steps below carefully to see what you need to be on the look for.

We removed the malicious applications from Android Market, suspended the associated developer accounts, and contacted law enforcement about the attack.

We are remotely removing the malicious applications from affected devices. This remote application removal feature is one of many security controls the Android team can use to help protect users from malicious applications.

We are pushing an Android Market security update to all affected devices that undoes the exploits to prevent the attacker(s) from accessing any more information from affected devices. If your device has been affected, you will receive an email from android-market-support@google.com over the next 72 hours. You will also receive a notification on your device that “Android Market Security Tool March 2011” has been installed. You may also receive notification(s) on your device that an application has been removed. You are not required to take any action from there; the update will automatically undo the exploit. Within 24 hours of the exploit being undone, you will receive a second email.

We are adding a number of measures to help prevent additional malicious applications using similar exploits from being distributed through Android Market and are working with our partners to provide the fix for the underlying security issues.

And as you can see from our picture above, there is an app in the market that will help remove garbage from affected devices.  You don’t need to download it though; it’s just there so that Google can remotely push it onto devices in need.  More info can be found here.

Via:  Google Mobile Blog

Google Starts Remotely Removing and Fixing Malicious Malware from Affected Devices is a post from: Droid Life

After yesterday’s DroidDream malware story jumped into the tech spotlight, we heard opinions on the situation from a few of our readers, but never really got the feeling that any of you were all that concerned about any of it.  Sure, some of the big tech sites jumped on it and made it sound like Android was the worst thing to happen since Paris Hilton’s birth, but for the most part, average users seemed to be confident in the Google team and the openness of the market.  Is that the case or are you all just not being vocal about it?  No better way to let your voice be heard than through one of our polls.  So tell us…

Thursday Poll: Worried About the Android Market and Malware in Apps? is a post from: Droid Life

Yesterday was a bad day for the Android Market.  Popular Redditor lompolo discovered odd duplicates of some very popular apps in the market and decided to download a few to see exactly what the difference was.  The news was not pretty, and the guys at Android Police jumped all over it, looking for more.  What did they discover?   Well, that developer “Myournet” was taking popular apps from the market, repackaging them with malware included, and then republishing them to the market alongside the legitimate version.  Included in these new versions was the famous root exploit “rageagainstthecage” (yep, it was rooting devices) and other embedded apks which had the potential to do some serious damage and steal more information than you can imagine…

…it does more than just yank IMEI and IMSI. There’s another APK hidden inside the code, and it steals nearly everything it can: product ID, model, partner (provider?), language, country, and userID. But that’s all child’s play; the true pièce de résistance is that it has the ability to download more code. In other words, there’s no way to know what the app does after it’s installed, and the possibilities are nearly endless.

But that’s not all.  Android security machine Lookout, stepped into the situation to help ease minds of their customers, but also found two additional developers that were distributing similarly affected apps:  Kingmall2010 and we20090202.  With these 3 “developers” combined, there were more than 50 apps in the official Android Market that could potentially steal a massive amount of information from your smartphone.  

Lookout’s CTO had this to say on the situation…

DroidDream is packaged inside of seemingly legitimate applications posted to the Android Market in order to trick users into downloading it, a pattern we’ve seen in other instances of Android malware such as Geinimi and HongTouTou. Unlike previous instances of malware in the wild that were only available in geographically targeted alternative app markets, DroidDream was available in the official Android Market, indicating a growing need for mainstream consumers to be aware of the apps they download and to actively protect their smartphones. Lookout users are protected from all known instances of DroidDream.

All I can say is, know what you are downloading to your phones, people.  We’ve lived in a time filled with shady internet characters for a couple of decades now and you shouldn’t be blindly downloading apps from random developers.  If you haven’t heard of the person listed under the app you are about to download, maybe you should take 30 seconds, read some of the comments, do a quick Google search, and see what you come up with.

The first reaction for most people is to blame Google, but that’s a little unfair.  If you want openness, then you need to educate yourself a little.  Or you could all do your best to make the world a better place by stopping your searches for apps titled “Hilton Sex Sound” and “Sexy Girls: Japanese.”

And lastly, here are the apps you should probably avoid if they ever pop back up in the market…

Full list of infected applications published by “Myournet”:

Falling Down
Super Guitar Solo
Super History Eraser
Photo Editor
Super Ringtone Maker
Super Sex Positions
Hot Sexy Videos
Chess
下坠滚球_Falldown
Hilton Sex Sound
Screaming Sexy Japanese Girls
Falling Ball Dodge
Scientific Calculator
Dice Roller
躲避弹球
Advanced Currency Converter
App Uninstaller
几何战机_PewPew
Funny Paint
Spider Man
蜘蛛侠

Full list of infected applications published by “Kingmall2010″:

Bowling Time
Advanced Barcode Scanner
Supre Bluetooth Transfer
Task Killer Pro
Music Box
Sexy Girls: Japanese
Sexy Legs
Advanced File Manager
Magic Strobe Light
致命绝色美腿
墨水坦克Panzer Panic
裸奔先生Mr. Runner
软件强力卸载
Advanced App to SD
Super Stopwatch & Timer
Advanced Compass Leveler
Best password safe
掷骰子
多彩绘画

Full list of infected apps under the developer name “we20090202″:

Finger Race
Piano
Bubble Shoot
Advanced Sound Manager
Magic Hypnotic Spiral
Funny Face
Color Blindness Test
Tie a Tie
Quick Notes
Basketball Shot Now
Quick Delete Contacts
Omok Five in a Row
Super Sexy Ringtones
大家来找茬
桌上曲棍球
投篮高手

Via:  Lookout, Android Police

DroidDream Malware Enters Official Android Market, Chaos Ensues After Root Exploit Found Embedded is a post from: Droid Life