IDG News Service — Google (GOOG) will build new safeguards into Android Market, its application store for the Android mobile OS, following an attack that infected thousands of phones and forced the company to wipe the malware remotely from phones, it said late Saturday.

More than 50 applications in the Android Market were found to contain a program called DroidDream, which is capable of stealing information about a mobile device and, more dangerously, downloading other malicious applications to the phone.

Google was fairly silent about the problem until Saturday, when it confirmed in a blog post that it decided to use a command that remotely erases malicious applications.

Android users that have downloaded a malicious application will get an e-mail within three days from the address android-market-support@google.com explaining the situation, wrote Rich Cannings , Android's Security Lead. In addition to wiping malware, Google is also forcing an update on users called "Android Market Security Tool March 2011" which fixes the security issues that DroidDream exploits.

Some users may get a notification on their device that a malicious application has been removed, Cannings wrote. About a day after the vulnerabilities have been fixed, users will receive a second e-mail.

Phones running Android versions below 2.2.2 are vulnerable. The issues are fixed in the latest 2.3 version of Android, known as "Gingerbread."

DroidDream uses two exploits called "exploid" and "rageagainstthecage" to get installed on the phone, according to Lookout Mobile Security, a company that has analyzed DroidDream. The company was tipped off to the situation last week by a Reddit user going by the name of Lompolo.

Lookout posted a deeper analysis of DroidDream on its blog on Sunday, revealing more alarming details of the application. DroidDream is coded to only operate from 11 p.m. to 8 a.m., "a time when the owner of an infected device would most likely be sleeping and not notice any strange behaviors on the phone."

DroidDream gains root access to Android's Linux operating system. Google wrote that it appeared to gather a device's International Mobile Equipment Identity (IMEI) number and the SIM card's International Mobile Subscriber Identity (IMSI) number.

That information was sent to a remote service located in Fremont, California, according to Lookout.

After sending the information, DroidDream downloads a system application called "DownloadProviderManager.apk," which prevents someone from either seeing it or uninstalling it without other special permissions, according to Lookout.

That second stage application then collects additional information, including product identification, phone model, language used on the phone, country information and userIDs, Lookout wrote. It can also silently download other applications.

Continue Reading