A reddit user lompolo reported that he observed someone has stolen 21apps from android market, re-engineered it as an malware and reuploaded on the market.
As per Lompolo
Link to publishers apps here. I just randomly stumbled into one of the apps, recognized it and noticed that the publisher wasn’t who it was supposed to be.
Super Guitar Solo for example is originally Guitar Solo Lite. I downloaded two of the apps and extracted the APK’s, they both contain what seems to be the “rageagainstthecage” root exploit – binary contains string “CVE-2010-EASY Android local root exploit (C) 2010 by 743C”. Don’t know what the apps actually do, but can’t be good.
I appreciate being able to publish an update to an app and the update going live instantly, but this is a bit scary. Some sort of moderation, or at least quicker reaction to malware complaints would be nice.
some dexing and jaxing(where did I get these terms..) decompiling the code (with dex2jar and JD-GUI), the apps seem to be at least posting the IMEI and IMSI codes to http://188.8.131.52:8080/GMServer/GMServlet, which seems to be located in Fremont, CA.
EDIT2: The apps are also installing another embedded app (hidden as assets/sqlite.db), “DownloadProvidersManager.apk”. Not sure what it does yet on top of monitoring what apps the user installs.
EDIT3: I just received a reply to an e-mail I sent out to one of the developers affected:
“Yes, thank you, I was aware of it. I have been trying for more than a week now to get Google to do something about it. I’ve contacted them through every avenue I could think of, but haven’t had a response yet…until today. It seems the developer and all his apps have been removed from the market”
So Reddit seems to be Google’s preferred customer feedback channel
EDIT4: As noted in the comments below, the developer account and the apps have been removed from the market, and the links to the apps above do not work anymore. Also I’d like to give credit to the devs at Teazel for helping in identifying the exploit yesterday.
EDIT5: Some are asking whether something they installed and uninstalled a while back might have been one of the bad apps. According to Lookout Mobile Securitythese malicious apps were published on two additional dev accounts on top of the one I spotted. All three accounts have been wiped from the market, but info on the apps is still available on Appbrain: Myournet, Kingmall2010 andwe20090202. Kingmall2010′s account seems to be the oldest of the bunch, according to Appbrain it started publishing around Feb 11th. The other two around Feb 23rd. So find the app from Appbrain on those accounts and check the publishing date. As for what to do if you know you’re infected – I’m hoping docgravel / Lookout can provide some insight soon. Check the comments.
EDIT6: Looking at the download counts for all three accounts on Appbrain. They’re lagging behind the real counts, as they don’t update daily, so when the Market’s real download counts for Myournet yesterday totalled at 50k-200k, Appbrain is only totalling to 10k to 35k. Even so, adding Kingmall2010′s download counts from Appbrain (48k to 224k) to those I nabbed from myournet’s account on Market yesterday brings the total downloads to 98k to 424k. And that estimate is probably on the low side.
EDIT7: Symantec: “If users feel that they may have installed one of these apps, they should also check com.android.providers.downloadsmanager (DownloadManageService) in the “running services“ settings of the phone”
Last checked, the malware apps were removed from the market, but bad things can happen