Twenty percent of applications on Android Market let third parties access private or sensitive information, according to a report from security vendor SMobile Systems.
SMobile, which develops software for protecting smartphones, has performed an analysis of over 48,000 applications available on Android Market, and looked at what permissions are granted to the application by the mobile operating system.
The permissions—which allow applications to do a multitude of things, including initiating a phone call, reading SMS (Short Message Service) messages or identifying the phone’s location—are there to help people develop useful applications. But applications might also access those kinds of personal data for nefarious purposes, according to SMobile.
Besides the 20 percent of applications that let third parties access private or sensitive information, 5 percent of applications have the ability to place a call to any number, and 2 percent of applications can send an SMS to an unknown premium number, in both cases without user involvement.
A majority of these applications were developed with the best of intentions and the user data will likely not be compromised, according to SMobile. But there have been cases of the opposite: A bank phishing application that was published by an author by the name of Droid09 was found and removed from Android Market, it said.
Android’s security model requires that applications declare the permissions they will be using prior to installation by the user. An informed user can use these declarations to decide if they want to install an application or not, according to SMobile. However, the fact remains that there is no means available for a user to know for sure that the application they just downloaded is doing only what the user sees it doing, it said.
Google is not happy with the report, which a company spokeswoman said via e-mail falsely suggests that Android users don’t have control over which apps access their data. Not only must each Android application get users’ permission to access sensitive information, but developers must also go through billing background checks to confirm their real identities, and Google will disable any applications that are found to be malicious, the spokeswoman said.
Updated at 4:42 p.m. PT with a comment from Google.