Android gets new, increasingly advanced malware

Lookout is now warning us about a new threat that could possibly infect our Android phones. The latest development is a new type of malware that bypasses Google's jurisdiction to get direct access to your phone. It's scary stuff.

Last month Google remotely removed more than 25 applications from the market on the conviction that these were hiding a malware called DroidDream within its files. After Google handled the applications, these same guys went on to develop this new browser-based malware that is more advanced than any other ever developed for a mobile phone.

Normally malware would be hidden inside an application that you download from the market. With this new development, the malware is packaged with an APK that you can download right from the web. The site comes with an Android Market-like design, and functions pretty similar to the Google made version to give people the impression that they might be working with a Google created website. When you've found an application you want to install, the website takes you to a fake installation page that mimics that of the Android market and then you're prompted to install it via Android downloader.

After being installed, the application goes to work and pings different servers that will register your number to different premium SMS subscription services. These services generally would require you to answer questions or a PIN to register. This is where this malware flexes its muscles: It'll communicate with the malicious server without you ever knowing about it - until the bill comes of course.

Smartphones are starting to see malware and software is being developed to protect them from it. Android has been experiencing the worst attacks, but luckily Google is always working hard trying to protect you against these bad boys. The best way to protect your phone is by staying away from online hacked APK of an application that you can download from the market for a small fee. Instead, pay that small fee now so you won't have to pay an even bigger fee later.

On Chrome Web Store, Real Games Mix With Mario Knockoffs

We've heard it over and over again (and arguably for good reason): Nintendo does not make games for platforms it does not control. So, imagine my surprise yesterday when I stumbled across a dozen or so Mario games on Google's Chrome Web Store.

These games are no more real than that Rolex you bought for $15 in Times Square - they're unlicensed, generally low-quality knockoffs, taking advantage of the openness of Google's browser, which just turned five. Many of the store's new native desktop apps look like snazzy cousins of the apps you might find in the Google Play Store on Android; however, in Chrome's Web app store (I know, these product names are all confusing), it's still the Wild West.

In addition to the fake Marios, a cursory search of the Web app store yesterday turned up knockoffs of many other popular franchises: one for Fruit Ninja, two for Crash Bandicoot, four for Doodle Jump, nine for Candy Crush Saga and 10 for Sonic the Hedgehog. A source with knowledge of the store said Google investigates unauthorized apps if the content owners report the offending apps to the company.

These fakes mix with real apps, like Rovio's official Angry Birds Chrome Web app, and to separate the good from the bad, users have to check the developer's website name. For example, one of the Candy Crush Saga knockoffs lists as its website candycrushsaga.blogspot.com, which is not one of King's sites. The official site for that game is candycrushsaga.com.

I asked a Nintendo spokesperson if the company was aware of the Mario knockoffs, and she returned the following generic statement from Nintendo of America:

Nintendo video games are offered only on Nintendo systems such as the Wii U and Nintendo 3DS. Applications on the Apple or Google marketplaces that purport to be Nintendo video games are not legitimate and users who download these applications may expose themselves to spyware or other malicious software [...]

Wait, malicious software? Yes, it's possible, as 80,000 users learned last year by way of a fake Bad Piggies Chrome app. According to security company Barracuda Networks, that's the number of users who installed a bogus Bad Piggies and got some "aggressive adware" to boot. Bonus!

The Nintendo statement continued, "Nintendo actively monitors the unauthorized use of its intellectual property, and will continue to seek removal of any unauthorized content in these marketplaces."

Taking these specific games out of the Chrome store won't completely neutralize potential security threats posed by current or future games, of course. But the very thing that makes the store work - a search, discovery and recommendation-focused design that makes these games and services more accessible to Chrome users - may mislead gamers who don't think to look too closely.

"We remove apps from the Chrome Web Store that do not comply with our terms of service," a Google spokesperson said. Some of the Mario games I mentioned in my emails to the company have now disappeared from the Chrome store, but here is a screenshot of how they were showing up for me in the store's main trending section yesterday.