Android malware apps to hit one million this year

The number of malicious Android apps is on course to reach one million this year.

The number of malicious or "high-risk" Android apps now stands at 718,000, up 40% from 509,000 in the first quarter, according to a Trend Micro report.

The security company didn't provide comparable figures for PCs, but a first quarter report from McAfee claimed new samples of PC malware were up 28% between the end of last year and the beginning of 2013 to 120 million, so mobile malware remains comparatively small.

That mobile malware is growing at a faster clip isn't surprising, but the rise suggests attackers are starting to see Android as a potentially lucrative attack avenue.

About half of malicious apps focus on conning the user out of money by signing them up for pricey premium services.

Trend Micro added that the vast majority of malicious apps are still hosted on third-party app stores rather than Google Play, meaning the risk is minimal for Android users who stick to the official store.

Remote controllers
The proportion of malware that can take control of users' devices is only 2%, the company said, though it noted that malicious apps can have more than one function.

But Trend Micro added that concerns about the sophistication of remote controller malware outweighed the numbers, citing the Android "master key" vulnerability discovered last month.

The master key flaw allows hackers to exploit discrepancies in Google's cryptographic verification process, letting them replace seemingly legitimate apps in app stores with trojans. Security researchers said that it's up to device manufacturers to release patches for the flaw - meaning phone makers who choose not to issue updates will leave their users vulnerable.

"Due to the fractured nature of the Android network, it is very difficult for patches to reach all users in an effective timeframe," added Trend Micro's technology vice-president JD Sherry. "In some cases, users will never get patches as vendors leave their customers at risk of attack."

This article originally appeared at pcpro.co.uk