Google's Android Market web store opens new malware threat

245

Comments

  • Reply 21 of 93
    freerangefreerange Posts: 1,597member
    Quote:
    Originally Posted by derekmorr View Post


    I'd refrain from it if the posts here warranted it. I didn't use it in the past, but as the comments on here became increasingly shrill and closed-minded, it seemed appropriate. No matter. I've given tired of trying to talk sense into anyone here. It's a hopeless endeavor, since folks ignore evidence, have double standards, and, when all else fails, just make things up.



    We can only hope that your poor tired self goes away...
  • Reply 22 of 93
    Ignorance and obvious bias on the authors part, but given the site, I'm looking past that.



    As many have said, when you remotely install an app, it puts a big old notification in the notifications panel saying the app has been installed... unless you manually launch the app, the app can't do a single thing, much like when you install an app on an iPhone... until you launch it, its just idle data on the phone. It absolutely does not install anything without the user knowing... so everyone here who hasn't actually gone through the process yourself, you have no warrant commenting on the process.



    If Apple had done this very thing, the Apple crowd would be praising Steve for creating something that didn't exist before... but Apple has no intentions of being so forward thinking because of the chain that attaches your phone to the overpriced machines they sell. Devices are becoming more wireless in everything they do with each passing day... Apple needs to accept that.
  • Reply 23 of 93
    quadra 610quadra 610 Posts: 6,757member
    Guys, this is an Apple fansite.



    If you don't like reading disparaging opinions of Android and Google, I'm sure you'd be much happier elsewhere.
  • Reply 24 of 93
    drdoppiodrdoppio Posts: 1,132member
    I was curious how long it would take [brain]DED to cover this story. This "research" showed up on other tech sites a couple of days ago, and was immediately shot down as sheer idiocy. Clearly, some malicious person obtaining the password for your Google, Amazon, iTunes, bank, business mail, etc. accounts could be a problem, but not any more so for Google than for anything else. The fact that some "empty suit" decided to fake competence and spread some FUD does not mean that we should eat up the BS. DED seems to disagree.
  • Reply 25 of 93
    Quote:
    Originally Posted by Quadra 610 View Post


    Guys, this is an Apple fansite.



    If you don't like reading disparaging opinions of Android and Google, I'm sure you'd be much happier elsewhere.



    This article showed up on the news widget on my Nexus S which brought me here... the reason I felt compelled to respond is because the article is only telling part of the story... reading it without knowing first-hand how the process works leads you to believe your life is in danger if you have an Android phone which is completely not true. People are merely adding fact to the loopholes in the story.
  • Reply 26 of 93
    Quote:
    Originally Posted by AppleInsider View Post


    ...addition of malware and spyware to Android users' devices far too easy...



    But that's OK, because Apple is Evil and Google is Open.



    Quote:
    Originally Posted by otosnede View Post


    Ignorance and obvious bias on the authors part, but given the site, I'm looking past that.



    Uh, you're not 'looking past' anything if it's the very first thing you say. You're pathetic, but given who you are, I'm looking past that.
  • Reply 27 of 93
    Quote:
    Originally Posted by zencowboy View Post


    Google must scare the bejesus out of you Apple fanboys, since you now seem to spend more time bashing Google and Android than talking about Apple products.



    I would suggest that Sophos actually use the web-based Android Market before criticizing it. Any app that is downloaded to an Android phone shows up in the notification bar and the user must manually clear the notification to make it go away. It's hardly an "unattended, quiet install." Then again maybe the editors at AppleInsider don't understand a properly functioning notification system, because Apple has failed in its implementation on iOS.



    I used to enjoy AppleInsider, but you've all gone round the bend with your slavish worship of all-things Apple and willingness to bash Google without even considering whether or not your arguments make sense.



    Scare us? Don't make me laugh. Tell Google to crank out some hardware sweetie, then we can talk about the possibility of uncontrollable sweats.
  • Reply 28 of 93
    Quote:
    Originally Posted by Mister Snitch View Post


    But that's OK, because Apple is Evil and Google is Open.







    Uh, you're not 'looking past' anything if it's the very first thing you say. You're pathetic, but given who you are, I'm looking past that.



    I can feel the love (:
  • Reply 29 of 93
    Quote:
    Originally Posted by otosnede View Post


    I can feel the love (:



    You earned it.
  • Reply 30 of 93
    Quote:
    Originally Posted by Mister Snitch View Post


    You earned it.



    Thank you
  • Reply 31 of 93
    Quote:
    Originally Posted by 8CoreWhore View Post


    I don't see it as FUD. He's just reporting what this security researcher is reporting. This is the kind of thing people want to know. We each have our own risk aversion, if it doesn't bother you, so be it, but people want to know what's what...



    AI also reports negative news about Apple. Relax.



    Not Daniel. It never is apple's fault! No really!
  • Reply 32 of 93
    Quote:
    Originally Posted by AppleInsider View Post


    Purchased apps are then streamed directly to the user's handset and automatically installed. The problem, researchers say, is that there is no approval mechanism that would indicate to a user that apps are being installed. Therefore, if a third party were able to access a user's account information, they could easily install apps on the user's phone without that person being aware this was even happening.



    Why would there need to be when you approved it online? Duh.



    Quote:

    However, because the new web store makes it easy for a malicious third party to bypass these choices and simply install apps behind the users' back, Android users must now be extra vigilant to monitor what apps are installed on their phone, because there is no curation by Google and no installation approval on the device itself.



    Still hard to do when all installed apps are listed on your account online. They can't hide.



    Quote:

    In contrast, with a stolen Android Market account, malicious parties can not only make purchases, but also set up targeted, powerful malware that is "sold" to the user without their knowing and silently installed on their device wirelessly with no notification. These apps can then track the user, access their calling information, collect all kinds of sensitive information on their phone, and then upload it to foreign servers before the user is even aware that a new app was installed.



    Like mentioned, installed apps do not auto run, and still include all the security warnings.



    Quote:

    Until Google takes notice of the problem, Svajcer recommended that Android users choose a strong password. The millions of new Android users will also want to make sure they don't fall for phishing scams the way millions of iTunes users have. Rather than facing refundable unauthorized purchases, they could find their personal smartphone loaded up with malware, recreating the security meltdown similar to the one Microsoft faced with Windows XP.[c][url=http://www.appleinsider.com/articles/11/02/06/googles_android_market_web_store_opens_new_malware _threat.html]



    Oh no, an android user will just restore the phone and sync to the cloud. The horror, the horror.



    I expect nothing less from Daniel. Maximize your opponents flaws, pretend yours don't exist.
  • Reply 33 of 93
    Quote:
    Originally Posted by FreeRange View Post


    derekmorr, if you follow his posts, is an obvious troll and/or techtard who thinks everything should be free and hates apple's success and business model. He just hangs around here waiting to pounce on insightful conversation and insight.



    Thank you for proving my point. I was wondering how long it would take.



    See ya later, folks. I wish I could say it's been fun, but it hasn't.
  • Reply 34 of 93
    veblenveblen Posts: 201member
    Quote:
    Originally Posted by otosnede View Post


    This article showed up on the news widget on my Nexus S which brought me here... the reason I felt compelled to respond is because the article is only telling part of the story... reading it without knowing first-hand how the process works leads you to believe your life is in danger if you have an Android phone which is completely not true. People are merely adding fact to the loopholes in the story.



    I am a big fan of technology. I'd rather hear both sides. Is there some kind of notification on new software being installed when you buy software from the android market website? I didn't see any when I watched the Google webcast announcing the new feature but I could have missed it.



    OK, so I crack someone's Android Marketplace password. In order to install malicious software it would have to exist in the Android Marketplace somewhere right? Are the apps in the Android Marketplace reviewed and approved? How malicious can I make my software?



    Let's just assume I was also able to get my malicious software into the Android Marketplace. The app would get installed on the other person's phone. In order for it to behave maliciously would it have to be executed by the user or can I get it to run after installation or at boot without the user knowing?
  • Reply 35 of 93
    archosarchos Posts: 152member
    Quote:
    Originally Posted by franktinsley View Post


    I'm not sure if Appleinsider is going for objectivity but this article doesn't really help if it is. I love Apple products more than anyone, while it may be true that Android is more likely to have phishing going on, if you give out your password to your iTunes account, bad things can also happen. Is installing apps remotely worse? It could give them more information, but both systems still rely on the user keeping a secret password and people can still be phished through email and websites even on the iPhone. Besides, remote app installing is something Apple could easily add too and users would still need to keep their password a secret as always. The only thing this article is really bringing up is that Android doesn't curate apps and that doesn't really have much to do with remote over-the-air installing. In the end, Apple relies just about as much on users keeping their passwords a secret. Android a bit more, but again, this article doesn't really seem to make this site look good.



    Where is there a problem with "objectivity" in this article? It lays out a fairly serious security flaw discovered in Google's web store design, and relates this to how iTunes/iPhones work, clarifying that this problem is limited to Android.



    It also brings up iTunes security issues of the past year, hardly flattering for Apple.



    Given that millions of Mac and iPod users use Android smartphones, what is wrong with AppleInsider reporting on an issue that is important to them, and clarifying that it is not relevant to iOS users?



    You say this article "doesn't make the site look good," but you apparently don't even understand the issues being described. Perhaps the lack of objectivity is not AI, but you and Fandroid patrol who attack every DED article, regardless of its objectivity or its factual basis.



    Sounds like Dilger is right in pointing out that Android is no threat because its supporters are so afraid of any flaws that they make a smokescreen of attacks at the sources of the reports rather than publicizing the flaws so they can be fixed. This results in a weaker, not stronger platform.



    "We'll know when Android has legs because it will stand on its own." A good read:



    Why Apple Can't Be Too Worried About Android 3.0 Honeycomb Tablets Taking Away iPad Sales
  • Reply 36 of 93
    lkrupplkrupp Posts: 10,557member
    Quote:
    Originally Posted by derekmorr View Post


    Thank you for proving my point. I was wondering how long it would take.



    See ya later, folks. I wish I could say it's been fun, but it hasn't.



    Somehow I don't buy your declaration. You'll be back. Your ilk is attracted to Apple centric sites like moths to a flame. You simply can't help yourself.
  • Reply 37 of 93
    It's almost comical how consistently I can guess when it's one of Daniel's articles just from the headline.
  • Reply 38 of 93
    archosarchos Posts: 152member
    Quote:
    Originally Posted by sprockkets View Post


    Why would there need to be when you approved it online? Duh.



    Poor reading skills? If you can't handle Dilger's writing, perhaps you could just go to the security site and read it directly. It's the same message though. If an account is compromised (and millions of accounts are fished all the time), you're not just facing apps you didn't pay for that you need to ask to be refunded. You're ACTUALLY GETTING THEM INSTALLED ON YOUR PHONE!



    That's a very serious design flaw, one Google should have anticipated.



    Quote:

    Still hard to do when all installed apps are listed on your account online. They can't hide.



    Yes, and malware doesn't exist on Windows because everyone can see it in their Registry. How moronic, a new low for you, anonymous troll/Dilger-hater.



    Quote:

    Like mentioned, installed apps do not auto run, and still include all the security warnings.



    That's your reaction? Not, "Whoa, Google should fix this," but "NO PROBLEMS!!!!! PAY NO ATTENTION!! ANDROID IS FLAWLESS!!!"





    Quote:

    Oh no, an android user will just restore the phone and sync to the cloud. The horror, the horror.



    Seriously, that's your solution? After you've had malware installed on your phone, you "just" reinstall everything? Hey, worked for Windows XP, didn't it?



    Quote:

    I expect nothing less from Daniel. Maximize your opponents flaws, pretend yours don't exist.



    I see you are as grossly hypocritical as Google is in the whole Bing situation. Pot kettle black.
  • Reply 39 of 93
    veblenveblen Posts: 201member
    Quote:
    Originally Posted by Archos View Post


    Perhaps the lack of objectivity is not AI, but you and Fandroid patrol who attack every DED article, regardless of its objectivity or its factual basis.



    You make some good points in your post. However, I don't think that calling people fandroids moves the discussion forward. Especially when the person your talking to says they are a fan of Apple.



    I think the part that strikes me as sensationalist in the AI summary is this "These apps can the track the user, access their calling information, collect all kinds of sensitive information on their phone, and then upload it to foreign servers before the user is even aware that a new app was installed."



    Is this true? I don't see anything in the sophos article that says that the user wouldn't have to also execute the application for it to perform the malicious actions described in the AI summary. The sophos article says by cracking the username password the person will be able to "retrieve the details of Android devices registered in your name as well as the details of all the Market applications you have already installed." But that's all it says the cracker can do other than install it, unless you actually execute the app. I don't have an android phone and haven't ever installed an android application. Do you know if you can get an Android application to startup after installation without user interaction?
  • Reply 40 of 93
    mennomenno Posts: 854member
    Quote:
    Originally Posted by Archos View Post


    Where is there a problem with "objectivity" in this article? It lays out a fairly serious security flaw discovered in Google's web store design, and relates this to how iTunes/iPhones work, clarifying that this problem is limited to Android.



    It also brings up iTunes security issues of the past year, hardly flattering for Apple.



    Given that millions of Mac and iPod users use Android smartphones, what is wrong with AppleInsider reporting on an issue that is important to them, and clarifying that it is not relevant to iOS users?



    You say this article "doesn't make the site look good," but you apparently don't even understand the issues being described. Perhaps the lack of objectivity is not AI, but you and Fandroid patrol who attack every DED article, regardless of its objectivity or its factual basis.



    Sounds like Dilger is right in pointing out that Android is no threat because its supporters are so afraid of any flaws that they make a smokescreen of attacks at the sources of the reports rather than publicizing the flaws so they can be fixed. This results in a weaker, not stronger platform.



    "We'll know when Android has legs because it will stand on its own." A good read:



    Why Apple Can't Be Too Worried About Android 3.0 Honeycomb Tablets Taking Away iPad Sales



    The reason it's an issue is because on any given day a good chunk of the news on APPLEInsider is about Android and some "flaw" or how it's "Inferior" to iOS in some way. Often the articles posted contain quite a bit of FUD and when corrections come out, the original article is never updated (and by corrections, I mean from official sources, not in comments).



    If you want to post a comparison piece every once and awhile that's fine, but this sites tendency to jump on ANY Android story they can spin negatively speaks of something else entirely. Namely Click-Bait and pointless trolling. And don't point to Android forums as a comparison. Forums are fanboy/fandroid heaven, that's a given. But AppleInsider tries passing itself off as a news site about everything apple related.



    Tell me, how is this "security flaw" Apple related? And why not, for a point of comparison, list the tens of thousands of dollars stolen from customers via their iTunes accounts?



    And anything by DED isn't a good read. He has no clue about anything outside of Apple and (possibly) ATT. He's good at those things, he should stick to it. We get that he liked iOS, he's entitled to it. But if I wanted to read the entitled rantings of a pompous ass I would just read BGR's editorials.



    Let's look at the above issue. in order for this to be a threat:

    1- The hacker would have to upload malicious code to the google market. This is theoretically possible, but this code often gets reported rather quickly, and no one has done this yet. Google has the Kill Switch for this reason

    2- He would have to hack your Gmail account. If someone has your account, there's more to be freaked out about than getting some apps on your phone.

    3- He would have to install the app to your phone. Which would mean manual input unless he programmed a bot to work with Google's setup.

    4- The user would have to be an idiot not to see the "app installed" notification with an app he doesn't recognize.

    5- Idiot user would have to manually select to RUN the app from their phone. Aka: "Some app just installed itself on my phone and I have no idea what it does, let's open it and see what it's about"



    This isn't a "now someone can hack your phone by hacking your gmail" threat, this still requires significant end user interaction, and has so many what ifs in it as to be "largely" a non issue.
Sign In or Register to comment.