Symantec recants the "malware" warning.

[IOWA]

Symantec recants Android malware claims - Computerworld

Computerworld - Symantec has backtracked from assertions last week that 13 Android apps distributed by Google's Android Market were malicious, and now says that the code in question comes from an aggressive ad network that provides revenue to the smartphone programs.

The security firm's new stance was in line with that taken by Lookout Security, which on Friday questioned Symantec's conclusions and instead said that the apps displayed the same behavior as others funded by 10 or more similar ad networks.

Symantec dubbed the code embedded within the 13 apps "Android.Counterclank," and classified it as a Trojan horse, or malware. According to Symantec's researchers, the malware was a variation on "Android.TonClank," called "Plankton" by researchers at North Carolina State University, another Trojan first uncovered in June 2011.

The apps containing the Android.Counterclank code had been downloaded between 1 million and 5 million times, said Symantec, which used the Android Market's own published numbers to arrive at that range. That made it the "largest malware [outbreak] on the Android Market," Kevin Haley, a director with Symantec's security response team, said in an interview last Friday.

In a blog post Monday, Symantec retracted its earlier allegations and said that the Android.Counterclank code comes from an SDK, or software development kit, distributed to "third parties to help them monetize their applications, primarily through search."

Symantec declined to name the ad network that distributes the SDK responsible for the code it detects as Android.Counterclank.

Both Symantec and Lookout have noted that the ad network code used by the 13 apps is more aggressive than the norm.

"In general, it's changing the home page of the [smartphone's] browser, adding additional shortcuts to the desktop, adding and even removing bookmarks," said Haley in a follow-up interview today.

So, if the Android.Counterclank apps are not malicious, what are they? Adware, the name pinned to unwanted PC software in the last decade?

Haley wasn't ready or willing to assign a label.

"It took a while for some consensus then about what was adware or spyware, and what wasn't," said Haley, talking about the intense debate five-to-seven years ago about those terms. "But eventually that consensus was reached."

Symantec will still identify apps that include Android.Counterclank -- a name it's also continuing to use -- but will not delete them, said Haley.

"We will come up with labels when it's appropriate," said Halley. "Now, we will make sure that we tell customers what's going on on their phones. We'll tell them what it does, and let them make the decision whether they want to make the trade-off and keep the app."

That was essentially the same practices that security companies used initially during the debates over adware and spyware on Windows PCs. Eventually, most antivirus vendors moved to a more forceful approach, and started to automatically remove such software.

"This is an inevitable discussion on mobile," said Haley. "We're going to see app vendors experiment with how to monetize their apps on Android phones, more so on mobile than on the PC, because mobile apps are sold at very inexpensive prices or given away for free. It's understandable that we'll see some pushing the boundaries, or even going beyond them."

Symantec said it reported the 13 apps with the Android.Counterclank code to Google, but that Google said the apps did not violate any of its policies, and would remain in the Android Market.

"We expect in the future there may be many similar situations where we will inform users about an application, but the application will remain in the Google Android Market," Symantec noted.

Google has declined to comment on Symantec's original malware claims or on the counter-arguments made by Lookout Security.

 

[zombie kat]

"In general, it's changing the home page of the [smartphone's] browser, adding additional shortcuts to the desktop, adding and even removing bookmarks,"

Emphasis mine

It’s going to delete your stuff and they say it is not malicious

 

[Gmash]

Adding or deleting bookmarks seems pretty shady to me. Any app that did that to me would be gone quick!

 

[Rico ANDROID]

"In general, it's changing the home page of the [smartphone's] browser, adding additional shortcuts to the desktop, adding and even removing bookmarks," said Haley in a follow-up interview today.

So, if the Android.Counterclank apps are not malicious, what are they? Adware, the name pinned to unwanted PC software in the last decade?

Any app that adds links and changes my home pages ..is malicious enough for me.... i chose NOT install such.

 

[IOWA]

"In general, it's changing the home page of the [smartphone's] browser, adding additional shortcuts to the desktop, adding and even removing bookmarks," said Haley in a follow-up interview today.

So, if the Android.Counterclank apps are not malicious, what are they? Adware, the name pinned to unwanted PC software in the last decade?

Any app that adds links and changes my home pages ..is malicious enough for me.... i chose NOT install such.

Then the answer is simple, don't install it. It's not harmful to the system, but there is generally some sort of price to pay for "free" goods.

 

[Rico ANDROID]

...and aint that the truth.
thats one "price " I can do without. Im sure I could find an app (if needed that badly) to provide me the service I need without highjacking my device

 

[zuben el genub]

So that can't happen to Iphone and Windows phone? I seem to remember some tracking stuff and other malware written for those platforms.

Symantic had a problem with PC Anywhere. It wasn't secure. They are a security company?

Looked like a ploy to increase sales. If you want an AV, there are plenty of others besides Symantic.

Some of the listings could have been like the bits included with Superoneclick. Your security system says some of the bits are a trojan. Yet we use it.

I do read permissions and some of the permissions wanted do sound scary. I've seen one dev explain why his app needed something that might access contacts. All of the devs should.

Right now I'm looking for an App Locker - have you read the permissions?
If it wasn't for places like Android Lounge for ratings and explanations - you'd never install it.