Android app test demonstrates dangers for mobile devices
Connecting state and local government leaders
The examination of 10,000 applications reveals signs of potential trouble and suggests ways to protect smart phones.
LAS VEGAS — A security evaluation of 10,000 Android applications found that many of them, while not necessarily malicious, were leaky and noisy.
Nearly 30 percent of the apps tested accessed the smart phone’s unique equipment or subscriber identity number, for instance, and many of these reported the number over the Internet to a server, often in the clear.
“That is definitely a privacy problem and a security problem,” said Neil Daswani, CTO of Dasient Inc., the company that did the tests.
Related stories:
3 in 10 Android users now face malware attack
Will smart phones replace your Internet connection?
But a comparison of the behavior of different types of apps also produced some diagnostic characteristics that could be used to identify malicious software for mobile devices. This is important in light of the growing number and advanced functionality of smart phones, which is attracting the attention of both security companies and criminals.
“It’s going to be a high priority,” said Daswani, who is presenting the results of the study at the Black Hat Briefings the week of Aug. 1.
Mobile malware for years has threatened to be the “next big thing” in hacking, and the number of exploits discovered this year, though still small compared with those targeting desktop and laptop devices, suggests that 2011 might actually be the year.
“The point of least resistance is still the desktop,” said Brad Hibbert, vice president of strategy and products for eEye Digital Security.
But mobile devices are becoming more powerful, and just as the laptop has in many instances replaced the desktop as the platform of choice, handhelds are beginning to replace the laptop. In addition to Web browsing, messaging and e-mail, they are being used increasingly for online banking and making payments. Coupled with features such as Global Positioning System receivers, cameras and a proliferation of applications, “it makes it a very interesting platform to attack,” Daswani said.
The venerable Zeus Trojan was ported to the Symbian OS in 2010, in Zeus in the Mobile or Zitmo, and this year has seen the introduction of malware such as DroidDream, Plankton and GGTracker. But although the mobile landscape is not yet as threatening as the traditional PC arena, security also is lagging.
Most observers expect the mobile security market to mimic the desktop market of 15 years ago, relying first on static, signature-based antivirus programs, with more dynamic behavior-based solutions following.
“The sophistication [of signature-based tools] is increasing over time,” Daswani said. But the problem with behavior-based tools is the smaller memory and greater competition for CPUs in the handheld device. Because of this, Dasient is pushing a cloud-based approach that would provide the analysis as a service, checking out applications upon download or when a transaction is initiated.
That was the purpose of the study of 10,000 Android apps, to identify normal application behavior and create a baseline for evaluation.
“We did find a number of interesting things,” Daswani said.
One is the number of processes being used by the application. When running on an emulator for 30 seconds, legitimate applications had about 58 processes running, give or take 4.5 processes. But that number increased by an order of magnitude for the malicious DroidDream, which invoked an average of 660 processes.
“When it runs, it tries to get root access on the device,” Daswani said. Although an absolute number of processes could not be used as an indicator of malicious activity, a significant increase beyond the average should raise a red flag.
Another possible diagnostic tool is Short Message Service activity. Although a small number of legitimate apps sent SMS messages on startup, they generally were limited to a single message sent to the number of the phone they were installed on. This typically was a text thanking the user for installing the app. But some malicious apps send multiple texts to premium numbers for which the user is charged. A pattern of multiple messages, especially to premium numbers, could be an indicator that all is not well.
“We have knowledge of hundreds” of such indicators, Daswani said.