Japanese govt: Use operator-run app stores, not Google Play
Info-stealing sexy wallpaper app was downloaded 500,000 times on official site
Ensure Ease of Recovery with Asigra’s Agentless Software
Google’s security credentials have taken another hit after the Japanese government warned local Android users to download their apps from third party operator-run stores, and not Google's own Play, following the discovery of a prolific info-stealing app on the official site.
The Tokyo-based Information Technology Promotion Agency (IPA) alerted domestic Android users last Friday that a rogue app named “sexy porn model wallpaper” had already been downloaded 500,000 times from Google Play before being spotted and removed.
The app, which promises “sexy fresh girls wallpaper”, works like many others of its kind by requesting user permission to access phone information including location details, email address and terminal information before sending it on to a third party server.
While not containing any malware, the app has no good reason to request access to such info, and effectively uses the “sexy girl” content to distract users while lifting this data in the background, said IPA.
The government-backed body warned users off Google Play and instead urged them to visit third party app stores run by mobile operators – such as KDDI’s “au Smart Path”, Docomo’s “D Market” and Softbank’s “Yahoo! Market” – saying that, “in these markets, operators carry out their own checks of the app”.
Google’s Android ecosystem has long been criticised for its lack of in-built security checks, although the Chocolate Factory responded to concerns by launching an app verification service for Google Play recently.
That said, its efficacy has been called into question by researchers, and the security vendor community is claiming threats will continue to snowball on the platform.
Trend Micro, for example, predicted recently that the number of malicious and high-risk Android apps would reach the one million mark this year. ®
COMMENTS
And this, gentlemen, is why…
Android should by default allow the users to selectively block access rights from apps; at least the right to send data over the network. I'm tired of arguing this point when it is such a no-brainer. All I could ever hear against is how poor developers should not have to handle their applications losing access to this or that… But anyway apps don't always have access to the network, e.g on planes, so this is pretty moot.
Re: During the meanwhile ...
You do read your gmail account from all three (four), right?
Hi welcome to 2013. You seem to come from a time period when this was news.
Obviously, if you are going to use free products (gmail, yahoo mail, hotmail/outlook) "the man" will be tracking you and knows exactly what kind of pr0n you like. That's the way the world works. You do know using gmail isn't compulsory to use the internet, right?
Back to the headline: Yeah Google need to pull their finger out. Their Google Play security stinks. Then again, users should ask themselves, "why would a sexy wallpaper need access to my phone book?"
Re: Japanese govt are quite clearly idiots
They of course are safe. The only people claiming Google play isn't safe, are Apple and vendors of Android Malware "solutions"
The reality is.
a) Google scan all uploaded apps using their Bouncer tech. Other stores (inc Amazon) don't do this.
b) Goole have the ability to remote uninstall any apps that slip through the net -Other stores also can't do this.
c) Corporates can apply a group policy that prevents apps or non approved apps being installed.
d) My Nexus 4 even offers to scan my phone for know dodgy sideloaded malware APKS.
Why is nobody talking about the rather GOOD preventative measures? Because it doesn't make for sensationalist bullshit stories, that's why....
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Steps to Take Before Choosing a Business Continuity Partner
Enabling efficient data center monitoring
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
