Google Pulls Two Android Market Apps

Google’s Android team has facilitated the removal of two free applications from the Android Market, citing violations of its developer terms.

Android Security Lead Rich Cannings on 24 June said his team used Android’s remote application removal feature to remove two applications created by a security expert for research purposes. In essence, the applications duped users into downloading them, although they were of little consequence.

“These applications intentionally misrepresented their purpose in order to encourage user downloads, but they were not designed to be used maliciously, and did not have permission to access private data—or system resources beyond permission.INTERNET,” Cannings wrote.

“As the applications were practically useless, most users uninstalled the applications shortly after downloading them.”

Android kill switch

He added that while the researcher voluntarily removed these applications from Android Market, the Android team invoked the remote application removal feature, a so-called kill switch, on the remaining installed copies to complete the cleanup.

This kill switch was created to help the Android team quickly remove applications that are malicious and pose a threat to consumers of Android smartphones, tablets and other devices. Customers receive a notification from the Android team if the kill switch is used.

There are currently 65,000 applications in the Android Market running on about 60 Android-enabled smartphone models.

Removal of applications from the Market is a relatively rare occurrence compared with Apple’s App Store, as some of the leading mobile application store’s 225,000 applications seem to be removed from that store on a regular basis.

The reason is usually because the content is of a sexual or perverse nature, which flouts Apple’s PG-rated App Store rules. Not always, though. Pulitzer Prize-winning cartoonist Mark Fiore saw his NewToons banished from the App Store for ridiculing public figures.

Removals often come to light via the developers whose apps have been jettisoned. Such situations are often fraught with tension because the application developers who invested their time and effort in developing for Apple or Android feel betrayed.

Accessing sensitive information

So, why then, did the Android team announce this move? Perhaps it was the recent negative impression that Android applications are havens for malware: Security vendor SMobile Systems published a report (PDF) implying that a large number of Android applications are malicious.

The SMobile report analysed more than 48,000 Android Market applications and found that 20 percent request permission to access sensitive information that an attacker could use for some malicious purpose.

In an email to eWEEK, Google said the report falsely implies that Android users don’t have control over which applications access their data.

“Not only must each Android app get users’ permission to access sensitive information, but developers must also go through billing background checks to confirm their real identities, and we will disable any apps that are found to be malicious,” Google said.

In any event, Cannings added that Google has a super kill switch that goes beyond the remote application removal capabilities, noting, “In case of an emergency, a dangerous application could be removed from active circulation in a rapid and scalable manner to prevent further exposure to users.”

The point is that Google wants users to believe it is serious about Android application security.