Maybe I should stop keeping that Android in my pocket.

I'm getting more and more e-mail from security vendors in a fever about malware targeting my phone of choice. To call it a new wave of FUD would probably be unfair. Everyone has a smart phone now, so naturally the bad guys are putting more focus there.

I also know from recent presentations that smart phones have many of the same old flaws we thought went away sometime between 2002 and 2007.

That's a bad combination.

Still, I can't help but feel underwhelmed by all the malware reports coming out. To be honest, I think it's a case where so many people (security vendors) are standing in a room talking at the top of their lungs at the same time it becomes increasingly difficult to separate the important dialog from the echo chamber.

The latest noise comes from Symantec in a write-up about Android.Pjapps, which spreads through altered versions of legitimate apps hosted in unregulated third-party Android marketplaces. Symantec says:

Android.Pjapps masquerades as a popular “Steamy Window” app. The legitimate features of the original app are still present in the malicious version, but it also features additional functionality that allows an attacker to build a botnet. Among other things it is able to install applications, navigate to websites, add bookmarks to the user’s browser, send text messages and block text message responses. It also sends sensitive user information back to the attacker.

Looking at the threat capabilities, Symantec believes it has been designed and may be used to peddle ad campaigns and to obtain benefits from the use of third-party premium rate services at users’ expense.

Looks a lot like the research other vendors are sending me. But Symantec offered something more that made me stop and take notice: Tips on how to protect yourself.

Here's the company's advice, which is reasonable enough until you get to the last two bullets:

•Only use regulated Android marketplaces for downloading and installing Android apps.

•Adjust Android OS application settings to stop the installation of non-market apps.

•Review other users’ comments on the marketplace to assist in determining if an app is safe.

•During the installation of Android apps, always check the access permissions being requested for installation; if they seem excessive for what the application is designed to do, it would be wise to not install the application.

Now for the product pitches:

•Utilize a mobile security solution on devices to ensure any downloaded apps are not malicious.


•Enterprises should consider implementing a mobile management solution to ensure all devices that connect to their networks are policy compliant and free of malware.

Product pitches aside, the advice is still decent.

--Bill Brenner