Android security issues

In the 24 November 2014 article in this column, I talked about how the Android-targeted malicious software named “NotCompatible” had resurfaced. This virus eats up the bandwidth (data) in your Android smartphone and can shorten the life of your battery by allowing others to use your device to perform some functions unbeknownst to you. The […]

In the 24 November 2014 article in this column, I talked about how the Android-targeted malicious software named “NotCompatible” had resurfaced. This virus eats up the bandwidth (data) in your Android smartphone and can shorten the life of your battery by allowing others to use your device to perform some functions unbeknownst to you. The NotCompatible virus has been infecting Android smartphones since March 2012. The U.S. Company Lookout Mobile Security has been following this virus since it was released. According to Lookout, the virus also showed a sharp uptick in activity in March of 2013, turning Android devices into unwilling web proxies (or intermediary access points to the web). Then, on 20 November 2014 the virus affected at least four million Android users in the U.S. and perhaps many more worldwide. The NotCompatible malware was first discovered by chance and brought to Reddit, a social news site and message board. At risk are people who have enabled “side-loading” – the ability to download apps from unofficial sources. The main effects of the virus on your smartphone are believed to be mostly limited to the use of your phone as proxy for carrying out mischief on the web.
More commonly, criminals infect your smartphones by first infecting, with malicious codes, the websites that you visit. When you visit the site from your phone, you unknowingly download the code. This is sometimes referred to as “drive-by-download.” In other scenarios, the spam from hijacked e-mail accounts is sent to your phones, a means that Lookout ascribes to more than 200,000 infections a day. Furthermore, and more recently, the bad guys trick you by installing the malicious code into your device as a security patch in an e-mail attachment.  The trick of sending e-mails advertising “weight-loss” solutions with a link that served up malware to Android users has also been documented.
Alcatel-Lucent researched into NotCompatible and published a “Malware Analysis Report” on it on 24 January 2014. The company regarded NotCompatible as one of 2013 top mobile threats. According to Alcatel-Lucent, NotCompatible is an Android bot that uses the infected phone as a proxy for this illicit web browsing activity. The company also found out that the command and control (C & C) servers for the bot are located in Germany and Holland and suggested that “the protocol is the same as a Windows based web proxy bot.” “This is the first time we’ve seen a common C&C infrastructure shared between Windows and Android malware. As for the origin of the name – “NotCompatible” comes from an early version that used a ruse about the Android browser being not compatible with the web site that served the malware.” “The malware was delivered as an update to fix that fictional problem.”
To further illustrate Google’s challenges with malicious software, security-software maker Avast commented just a few days ago on three malicious Android apps that made it to the Google Play app store. These particular apps would go into sinister mode after 30 days on a device, and then begin spamming users with advertisements.
According to Avast, the infected apps – the “Durak” card game, an “IQ Test” and a Russian history app – were distributed widely, with “Durak” being downloaded between 5 and 10 million times. If you have any of these apps installed on your device for more than 30 days, a threatening ad would pop up each time you unlocked your phone, saying that your device was out of memory, experiencing a security hole or some other false claim. Of course, you should delete these apps from your phone if you have somehow downloaded them.
That the three malicious viruses weren’t caught before Google accepted to have the apps published in Google Play suggests the need for a more rigorous app-vetting process by Google. I know Apple spends almost a week to vet your apps before publishing them. (Publishing in Google Play is almost instantaneous.)
Although Google championed the cause of mobile phone security in the past, such as the use of encryption, its decision to stop supporting Android versions older than 4.4 suggests the challenge the company is facing in addressing security issues. Android 4.3 and early versions are probably being used by two-thirds of the billion-plus Android devices in use. Last week, Android Security Chief, Adrian Ludwig, acknowledged the challenge in keeping software up to date. He also noted that the affected software has more than 5 million lines of code and fixing bugs in it could require “changes to significant portions of the code and was no longer practical to do safely.” This is obviously an unfortunate situation for the consumer, who finds himself using a vulnerable OS that no longer has a security patch!
The bottom line The Android operating system appears to be vulnerable to computer viruses. Meanwhile, Google, the developer of the operating system, has decided it will no longer support Version 4.3 and older, making your smartphones potentially very susceptible to virus attack.