Majority of financial apps on Android have been hacked, and nearly a quarter on iOS, says report from Arxan
It is easy for people to put a 'Bank of America' app onto Google Play which simply uses freely available information about the bank - and fool users, says Arxan. Photograph: Mark Lennihan/AP
Huge numbers of apps in both Apple's and Google's app stores have been targeted for hacking, with financial apps on Android particularly vulnerable, according to new research.
In significant numbers of cases, apps have been hacked and uploaded to third-party stores or Google Play either to capture credentials from users, or to operate maliciously, or to defraud the app's creator by removing adware elements.
"Hacked apps are showing up in a lot of different storefronts, such as Cydia, in a decrypted state, so by definition the software has been hacked," said Kevin Morgan, chief technology officer of Arxan, an app security company. "There are multiple examples where there has been some tampering with the original code."
Financial apps are a particular concern because users trust them with essential data such as bank account numbers and passwords. Arxan says it found that 23% of its sample of iOS financial apps had been hacked and reposted - and 53% of Android financial apps.
Android users can download apps from third-party stores via setting on their device, whereas iOS users have to "jailbreak" their device - that is, use a hacking attack to give themselves the equivalent of "root" privileges for installing software. At present there are no jailbreaks for iOS 7, released in September.
But even Google's official Play store can be a source of malware and hacked apps. In September BlackBerry had to halt the rollout of its BBM app for Android because a hacked version placed in the Play store before the official one had been downloaded more than a million times.
Similarly, it is easy for people to put a "Bank of America" app onto Google Play which simply uses freely available information about the bank - and fool users, Morgan warned.
"Google Play isn't a vetted app store - it tends to have a lot of cruft," said Morgan. "Whereas in the Apple Store you're almost certain to see just legitimate apps. Hacked code isn't a significant problem in Apple's App Store." Apple vets all apps before allowing them onto its App Store, where Google will remove apps only after they appear if there are complaints about them or if they are detected as having malware. Both platforms have a "kill switch" which can retrospectively delete malicious installed apps from phones.
Arxan, based in Bethesda, Maryland, offers a security system for apps which makes it harder to tamper with them, and can enable them to try to detect tampering - and prevent execution if it is found.
Picking a fight
In its second annual report on the state of security in the app economy, it says: "Our research yields consistent findings [with last year] of 100% of the top paid Android apps are subject to hacking. This consistency from last year clearly underlines that Android is the more insecure operating system."
How does that square with Eric Schmidt's claim in October that Android is more secure than Apple's iOS - a statement which at the time elicited laughter from executives attending the Gartner symposium?
"I'm not sure I want to pick a fight with Eric Schmidt," said Morgan. "His argument is a technical point-by-point one" - though Schmidt did not give a detailed explanation of his claim to the audience in October, preferring to say that Android undergoes "real-world testing" through its huge user base.
Morgan explained: "from the basis of the app marketplace, the fact remains that there's a lot more modified code there than on Apple's store. There are fraudulent, malware-infested apps based on original code or built from scratch in Google Play."
Arxan also noted that "hackers can more readily target a fragmented, and open Android ecosystem to insert malware into the Google Play store." It points to Google's own platform data, which shows that at the beginning of December 24.1% of devices accessing Google Play were running Android 2.3 "Gingerbread", released in December 2010, and 18.6% running version Android 4.0.x, released in October 2011.
Follow the money
"This lack of standardisation leads to greater insecurity on this platform," Anxar says in its report, prepared in September, when Gingerbread and ICS devices made up 52.4% of devices accessing Google Play. "Specifically, the majority of Android devices will not be able to receive new security measures provided by Google, which results in users being vulnerable to even known threats."
While the proportion of devices running older versions of Android has fallen since the report was prepared, the absolute number is likely to have stayed almost unchanged.
"Hackers will always follow the flow of money, and will focus on the platform with the most users," the report adds. "A recent mobile malware study by Junpier substantiates this by reporting that 92% of malware was created for Android, and malware on iOS was not noticeable."
Arxan's analysis found that third-party stores are a significant source of hacked apps. Its research found hacked versions of all of the top 100 paid apps for Android, and 56% of the top 100 paid apps for Apple's iOS either on the main store or third-party sites.
In the main, free apps are the most targeted: 73% of free Android apps had been modified and either reposted to Google Play or to other app stores
