Security research labels more than 290,000 Google Play Android apps as 'high-risk'

One-quarter of more than 400,000 Android apps examined in the Google Play store pose security risks to mobile-device users, according to new research.

SECURITY: Android malware market exploding, says Trend Micro

Security vendor Bit9 categorized these Android apps as "questionable" or "suspicious" because they could gain access to personal information to collect GPS data, phone calls or phone numbers and much more after the user granted "permission" to the app. "You have to say 'yes' to the application or it won't run," pointed out Harry Sverdlove, Bit9 CTO. Games, entertainment and wallpaper apps especially seem to want to grab data, even though the their functions would seem to have little direct use for it.

Bit9 notes this doesn't mean these apps are malware per se, but they could do damage if compromised because the user has granted so much permission.

There are said to be about 600,000 apps in Google Play, and Sverdlove says Bit9 is now compiling a "reputation" database of Android apps. The firm is also going to move on to other app stores, including those from Apple and Amazon, in order to create mobile security products that can protect users based on risk-scoring of apps. 

Reputation-based approaches have become commonly used throughout the security industry for protecting Web users, for example, against malware-infested sites, and now there's interest in applying similar ideas to analyzing risk associated with mobile apps.

Broken down, Bit9 categorized these "questionable" and "suspicious" apps it found in Google Play this way:

* 42% access GPS location data, and these include wallpapers, games and utilities

* 31% access phone calls or phone numbers

* 26% access personal data, such as contacts and email

* 9% use permissions that can cost the user money

In its report, Bit9 describes its methodology as crawling Google Play to collect detailed information about 412,000 mobile apps, including publisher, popularity, user rating, category, number of downloads, requested permissions and price.

Of the 412,222 Android apps evaluated from Google Play, Bit9 says more than 290,000 of them access at least one high-risk permission, 86,000 access five or more and 8,000 apps access 10 or more permissions "flagged as potentially dangerous." It defined risk level according to relative degrees of privacy intrusion and the app's feature set, perhaps the ability to wipe devices or change systems settings.

The study also included a survey of 138 IT professionals responsible for mobile security for over 400,000 users in their organizations. It found:

* 78% think phone makers do not focus enough on security, but 71% allow employee-owned devices to access their organization's network.

* Only 24% deploy some form of app monitoring or control to grant visibility into employees' devices.

* 84% feel Apple iOS is "more secure" than Android and 93% of respondents allow iOS to access their network. Only 77% allow Android devices, and in something of a surprise, 13% say they allow rooted Android or "jailbroken" iPhone devices onto their networks.

* 96% allowing personal devices also allow employees to access email using the device, while 85% allow access to company calendar data.

The potential for trouble in all this, according to Bit9, is that apps that can access all this user data could become the open door for hackers to exploit in the future.

Ellen Messmer is senior editor at Network World, an IDG publication and website, where she covers news and technology trends related to information security. Twitter: @MessmerE. Email:

Read more about wide area network in Network World's Wide Area Network section.

Join the CSO newsletter!

Error: Please check your email address.

Tags android malwareNetworkingwirelessandroid appsmobile appsAppleconsumer electronicsGoogletrend microsecurityBit9smartphonesGoogle Android

More about Amazon Web ServicesAppleGoogleIDGTrend Micro Australia

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Ellen Messmer

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place