Android malware begs behavioural change
Early last week Google removed a bunch of malicious apps, most disguised as legitimate, from the Android Market after they were found to contain malware. The malware, dubbed DroidDream, uses two exploits to steal information such as phone ID and model, and to plant a backdoor on the phone that could be used to drop further malware on the device and take it over.
"At a minimum, they have to do signature-based scanning for known malware," application security provider Veracode chief technology officer, Chris Wysopal, said. "DroidDream is now a malware kit and it would be easy for people to make variations of it and insert it into new software."
But traditional signature-based antivirus software isn't good at detecting brand new malware or existing malware that has been modified enough to slip past the antivirus programs. To catch something like DroidDream then, behavioural-based antivirus scanning should also be used, according to Wysopal.
