Researchers bypass Google's Android malware detector

Mobile security researchers say they have identified flaws in Google's system to keep malware off Google Play.

Duo Security's Jon Oberheide and Charlie Miller say they exploited weaknesses in Google's Bouncer service to sneak malicious apps on to the Android market. Oberheide demonstrated in a video presentation (see below) how he submitted a fake app and used a remote shell it got access to when Bouncer attempted to analyze the app. That access allowed the pair to "look for interesting attributes of the Bouncer environment, such as the version of the kernel it's running, the contents of the file system, or information about some of the devices emulated by the Bouncer environment," he said.

"This is just one technique to fingerprint the Bouncer environment, allowing a malicious app to appear benign when run within Bouncer, and yet still perform malicious activities when run on a real user's device," Oberheide said in the video, which was released today ahead of a planned presentation later this week at the SummerCon conference. Introduced in February, Bouncer is an automated process that scans apps for known malware, spyware, and Trojans, and looks for suspicious behaviors and compares them against previously analyzed apps. If malicious code or behavior is detected, the app is flagged for manual confirmation that it is malware.