Awful article. It specifically says "apps in the Google Play marketplace", when the sourced article specifically says "more than 7,000 apps downloaded from non-Google-owned stores". It then goes on to list a couple of popular apps, insinuating that the official versions of these very popular apps in the Google Play marketplace are infected, when that is entirely untrue.

People have been taking popular software, wrapping them in malware, and redistributing them in skeevy channels since the dawn of software downloading.

The article claims that trojans spread through Google Play which is false.

The original reports explain that the trojans come from small 3rd party stores and illegal downloads.

Who honestly didn't see that one coming?

That the article is wrong about the attack vector: sure. But still: that's a botnet that may already be in command of one million zombified smartphones. That is quite a feat.

And you know what? If when the ability to install app came out people had been criticizing it here, saying it was a major security disaster waiting to happen and that millions of smartphones would become part of a botnet, there would have been a backlash here.

People would have downmodded "naysayers" like crazy, lamenting that HN is too negative, that everytime the security topic comes out people thinking they're smarter than other open their big mouth, etc.

So I'll say it very clearly: this is just the beginning. You'll only see more and more crazy stuff like that.

Just as for years and years we've heard about desktop and laptop computers being part of gigantic botnets, we'll now hear about smartphone botnets.