Google's Android Market attacked

Google has confirmed that a number of malicious applications were published to the Android Market last week, forcing it to issue a security update.

The web version of its Android Market was launched in February, allowing users to browse and download apps from their desktops.

"Within minutes of becoming aware, we identified and removed the malicious applications,” said Android Security Lead, Rich Cannings.

The applications were said to have took advantage of known vulnerabilities which don’t affect Android versions 2.2.2 or higher.

"For affected devices, we believe that the only information the attacker(s) were able to gather was device-specific (IMEI/IMSI, unique codes which are used to identify mobile devices, and the version of Android running on your device). But given the nature of the exploits, the attacker(s) could access other data, which is why we’ve taken a number of steps to protect those who downloaded a malicious application,” continued the security update.

Google will remotely remove the malicious applications from affected devices. "This remote application removal feature is one of many security controls the Android team can use to help protect users from malicious applications,” explained Cannings.

There will also be an Android Market security update to all affected devices that undoes the exploits to prevent the attacker(s) from accessing any more information from affected devices.

"If your device has been affected, you will receive an email from android-market-support@google.com over the next 72 hours. You will also receive a notification on your device that ‘Android Market Security Tool March 2011’ has been installed.” You may also receive notification(s) on your device that an application has been removed.”

Cannings also said that Google has contacted law enforcement about the attack.