Another Android Trojan uncovered

Stephen Withers
Tuesday, 17 August 2010 11:58

Your IT - Mobility

It appears to be a harmless and classic game reworked for Android devices, but Tapsnake comes with spy software.

Security vendor Symantec is warning that Tapsnake, a game available through thew Android Market is actually part of a commercial spyware system that tracks the user's movements.

Tapsnake describes itself as "Yet another modification of the Google Android Snake game." And it is. The problem is that it includes a component that records the GPS coordinates of the phone, and then uploads it every 15 minutes.

Symantec officials have warned that the data is then accessible by using the commercial GPS Spy app on another Android device. GPS Spy can display a map showing the sequence of locations, with the ability to show the timestamp and exact coordinates of any of them.

Tapsnake is not a classic Trojan inasmuch as the tracking 'feature' needs an email address and key so the data can be retrieved by GPS Spy, but Symantec officials point out that other tracking applications don't masquerade as something else.

This setup requirement does limit the situations where Tapsnake/GPS Spy could be used covertly ("Think cheating spouses or keeping tabs on children" suggests Symantec), but Tapsnake does serve as a reminder of the risks of allowing someone else to install software on your device (you're the person that should be deciding whether to allow particular rights to an app), and the importance of watching the indicators displayed on the phone (why should the 'satellite dish' GPS icon appear when you play an arcade game?).

It was recently revealed that an Android wallpaper app was covertly sending sensitive data to a remote server, and further examples were subsequently found.