Broadband Tech > Security > Security > Symantec sounds the klaxon about Massive Android Botnet

Researchers from Lookout Security disagreed with rival Symantec that 13 apps on the Android Market were malicious, instead saying that they showed the same behaviors as other ad-supported apps.

Symantec's Kevin Haley, a director with the company's security response team, said Friday that 13 apps, some available in Google's official download store for at least a month, were created to distribute "Android.Counterclank," a Trojan that, among other things, modifies the browser's home page and bookmarks, and inserts a search icon that some users have said is impossible to delete.

Symantec estimated the number of downloads of the 13 apps at between 1 and 5 millions, prompting it to call the campaign the largest Android malware outbreak ever.

Lookout researchers disagreed.

"This is pretty clearly an ad[vertising] network that's similar to other ad networks," said Tim Wyatt, a principal engineer with Lookout, which markets a popular Android-specific security app.

Wyatt declined to identify the network he said was being used by the 13 apps -- which originate from three different publishers -- and that requests the permissions and exhibits the behavior Symantec dubbed malicious.

"This ad network does have the capability to enter bookmarks in your browser, which is different from other ad networks," Wyatt continued. "But a lot of its functionality is being embedded in other apps. Part of the business model of the company that owns the ad network is to add search conducted from apps."

"I can tell you that this code [seen in the 13 apps] is not the only code for doing things like this," said Wyatt. "There are 10-plus ad networks that we track that have the same functionality."

Wyatt said that Symantec had "significantly overblown" the story by labeling the apps as Trojan-infected, and added that its rival had been "a bit premature" in coming to its conclusions.

Symantec did not respond to a request for comment on Lookout's assertions.

The Defense Department and National Institute of Standards and Technology are close to approving security standards that will allow service members, DOD personnel and other government users to use Android mobile devices on classified networks.

“There were going to be no information assurance [standards issued] until 2014, but with the groundswell of interest and needs, the agencies responsible for certification are giving this a higher priority,” McCarthy said. “The key is that it allows users from DOD and other agencies to access databases that in the past they couldn’t get to using a smart phone.”

Those databases include mission-command tools such as the Tactical Ground Reporting system used for critical situational awareness in combat, as well as law enforcement databases such as the National Crime Information Center, he said.