Google releases security fix for Android smartphones

Google has released an Android security update after its applications store was infiltrated by over 50 malicious apps.

The Android Market Security Tool March 2011 patch is being rolled out over the air, and will remove any malicious apps automatically.

"We are remotely removing the malicious applications from affected devices. This is one of many security controls the Android team can use to help protect users from malicious applications," said Rich Cannings, Android security lead, in the Google Mobile Blog.

"If your device has been affected, you will receive an email from android-market-support@google.com over the next 72 hours."

The update will affect only those handsets that contain the malicious apps, and users may receive a notification on the device saying that the application has been removed.

The malicious Android applications were discovered on 1 March, and take advantage of vulnerabilities in devices running Android 2.2.1 and below.

The apps were removed from the Android Market on the same day, and Google suspended developer accounts and reported the matter to law enforcement agencies.

The apps allowed attackers to access the IMEI/IMSI codes used to identify individual devices and the version of Android running on the handset.

However, Google noted that the attackers may also have been able to access other information, which is why a remote removal was triggered.

Cannings advised people to be vigilant when downloading applications, and said that security in the Android Market is being bolstered.

"We always encourage you to check the list of permissions when installing an application from Android Market," he said.

"Security is a priority for the Android team, and we are committed to building new safeguards to help prevent these kinds of attacks from happening in the future."

Security experts have warned about the rise of malware aimed at smartphone platforms. Symantec reported an increase in malware targeting Android, highlighting the Android.Pjapps Trojan which collects compromised smartphones into a botnet.