Android adware 'infects millions' of phones and tablets

 

By Leo Kelion Technology desk editor

Google has suspended access to Durak card game among other titles

Android users are being warned that several popular apps that were on the official Google Play store appear to have contained hidden code that

made malicious ads pop up.
Security firm Avast said that one of the apps involved - a free version of the card game Durak - had been downloaded up to 10 million times, according to Google Play's own counter.
Google has now blocked access.
But one expert noted that the problem might be less widespread than feared.
Avast said that it first became aware of the issue after a member of the public contacted it after carrying out his own investigation into how his Nexus 5 smartphone had come to be infected with malicious code.
The "adware" was causing spurious pop-up messages to appear that had been made to look like system notifications. These told him his phone was running "slow" and that he needed to install new software to fix the problem.
If he followed the on-screen prompts he was then directed to download other apps, only some of which were legitimate.
"You get re-directed to harmful threats on fake pages, like dubious app stores and apps that attempt to send premium SMS behind your back or to apps that simply collect too much of your data for comfort while offering you no additional value," wrote Avast's malware analyst Filip Chytry.

The adware brought up a range of fake warning messages

The original apps were said to have held off showing the pop-ups until seven or more days after being installed, which the analyst suggested was intended to mask the fact that they were responsible.
"Most people won't be able to find the source of the problem and will face fake ads each time they unlock their device," he wrote.
"I believe that most people will trust that there is a problem that can be solved with one of the app's advertised 'solutions' and will follow the recommended steps, which may lead to an investment into unwanted apps from untrusted sources."
In addition to the Durak card game, other apps alleged to be involved include:

• A Russian language IQ test, which Google Play indicates had been downloaded up to five million times
• A Russian history educational tool, which Google Play indicates had been downloaded up to 50,000 times

A search by the BBC for other apps made by the same developers revealed dozens more apps, including video games, a psychology guide, wedding planning software and cookery tips - all of which have now been blocked.

A wedding planning app is among the apps that are currently blocked

The publishers involved have not replied to requests for comment.
A spokesman for Google said: "We're just confirming that all of the apps in the report have been suspended and nothing more."
Inflated numbers Although Google Play's own site indicated the software had been downloaded many millions of times, one security researcher was cautious about the figures.
"I would take the numbers with a pinch of salt because one thing that malware authors might do is deliberately up the amount of downloads in order to make an app appear more popular than it really is," said Dr Steven Murdoch from University College London's information security research group.
"Google does scan for malware that it knows about and it also has some more advanced techniques to detect malicious behaviour.
"But these don't work 100% of the time and some apps do slip through the checks - and there is a continual cat and mouse game of people looking for malware and the authors trying to bypass the checks."

Several of the apps involved have a Russian theme

Although Avast is using the publicity it has generated to promote its own security software, Dr Murdoch noted that it too would fail to identify all new types of malware.
One alternative, he said, was to check reviews.
Several people who had downloaded the Durak card game had posted warnings on Google Play as far back as November 2013, that they suspected it was forcing pop-up ads to appear.
"But that's still not going to catch everything," Dr Murdoch added.
"Phone users ultimately have to trust the operating system vendor - whether that's Google or Apple [or someone else] to protect them."