Google Fails to Remove All Versions of Super Mario Malware

A piece of malware found in Google's official app store was supposed to have been removed by Android Security, but a security expert has identified several more instances of the same virus still freely available on Google Play.

We reported earlier that Symantec's Irfan Asrar had discovered malware which sent premium rate SMS messages from your phone, which was embedded within two separate and popular games on the Google Play app store.

In his blog post on the discovery of the Android.Dropmailer malware, Asrar thanked Android Security for "immediately revoking the threat" once it had been informed by Symantec. The malware was identified in two popular games: Super Mario Bros and GTA 3: Moscow City.

However further investigation by security expert at F-Secure, Sean Sullivan, has found there are several other instances of the malware embedded in other apps within Google Play, which remain available for download at the moment.

These include another Super Mario Bros. app, a GTA 3: Las Vegas app, Instagram After Effects app and FIFA 11 app among others.

Sullivan also remarked on his blog post that the apps only work in specific countries: "Here's something clever. Premium rate SMS numbers only work within a particular country. So, this malware is "incompatible" outside of profitable networks."

As well as limiting the malware to its target audience, it makes it more difficult for antivirus researchers to collect samples.

We have contacted Google about the situation but instead of speaking about the matter directly, a spokesperson said: "We are committed to providing a secure experience for consumers in Google Play, and in fact our data shows between the first and second halves of 2011, we saw a 40 percent decrease in the number of potentially-malicious downloads from Google Play."

The spokesperson added: "Our approach includes clearly defined Content policies that developers must adhere to, plus a multi-layered security model based on user permissions and application sandboxing. Applications in violation of our policies are removed from Google Play."