Google officially responds to Android Market Trojan incident, remotely deletes Trojan programs on mobile phones

The news of the DreamDroid Trojan program appearing in the Android Market has caused a strong reaction. After all, no one likes to waste the limited functions of mobile devices on antivirus software. Google discovered this earlier last week and removed the related program from the Android Market. Yesterday, Google made an official response to this matter. The main points are as follows:

loss

• A total of 58 Trojan-containing programs were uploaded to the Android Market
• The apps were downloaded to about 260,000 devices before being removed by Google
• Google believes that only the IMEI/IMSI code of the mobile phone was leaked, and no data stored on the phone was lost.

remedy

• In addition to removing the app and freezing the developer account, Google has also contacted law enforcement agencies to intervene in the matter.
• In fact, the new version of the system has already patched the vulnerability exploited by the Trojan, and only versions 2.2.1 and below are affected
• Google will automatically remove Trojans from infected Android devices remotely without user intervention
• Google will automatically and remotely revoke the root privileges obtained by Trojan programs without user intervention
• Google will add more measures to the Android Market in the future to prevent similar incidents from happening again.

Some thoughts

Considering that the Trojan program has obtained root privileges, it is fortunate that no important information was leaked this time. Google's remote intervention is also very powerful. I guess many developers hope that Google can remotely delete pirated programs. The remote program deletion function used this time was officially released in June last year. At that time, Google stated that its target was Trojan programs and guaranteed that this function would use the notification system to inform users after deleting any program.

Apparently Google has already noticed this vulnerability and patched it in the Android 2.2.2 update. Unfortunately, for various reasons, most Android phones are still running 2.2.1 and below, and most of them will never be upgraded. The patch push for these models requires cooperation between Google and related mobile phone manufacturers and operators, so Google was not able to patch the vulnerability as soon as it discovered the problem. I hope that the patch push for these vulnerabilities can be separated in the future so that old models can also get updates in time.

Although the impact of this incident is bad, the loss to users is not big, but there is no guarantee that there will not be more serious Trojans in the future. Moreover, the official Android Market will be relatively strict in checking programs. Can the various third-party program stores, especially those small program stores of entrepreneurial nature, find similar programs in time? If a specific Trojan program does not enter the Android Market at all, but directly lands in a third-party program store, then users may not be able to wait for Google to remedy it in time. So I think it is better to be careful when trying third-party program stores.