Hacked websites delivering Android malware, warn security analysts

Bad news for owners of smart phones powered by Google's Android operating system. Security researchers say they've discovered NotCompatible, a piece of malware specifically targeting Android devices. And it's being spread using an old computer trick: drive-by downloads.

According to Lookout Mobile Security, NotCompatible "does not currently appear to cause any direct harm" to smart phones or tablet computers running Android. However, the Android malware can "be used to gain illicit access to private network," say the researchers.

More significant, NotCompatible appears to spread through hidden code at the bottom of Web pages on "compromised websites." Lookout's blog warns:

If a user visits a compromised website from an Android device, their mobile web browser will automatically begin downloading the NotCompatible application, named 'Update.apk'.

While the danger and spread of NotCompatible is currently believed to be low, security experts warn that the growing population of mobile device users can increasingly become victims of data and privacy crimes if they don't take adequate preventive measures.

For the five ways to protect your smart phone and other safeguards, check out Consumer Reports Guide to online security.

Sources:
Security Alert: Hacked Websites Serve Suspicious Android Apps (NotCompatible) [Lookout Blog]
For the First Time, Hacked Websites Deliver Android Malware [PC World]

—Paul Eng