New Android 'Fake ID' flaw empowers stealthy new class of super-malware

1246

Comments

  • Reply 61 of 103
    calicali Posts: 3,494member
    Isn’t that the definition? How people who’ve broken the constitution keep getting elected because their constituencies are too stupid to know, etc.?

    hey! I trust our governments because I've been taught since a child that they exist to protect our rights!!!! ;)
  • Reply 62 of 103
    dasanman69dasanman69 Posts: 13,002member
    cali wrote: »
    hey! I trust our governments because I've been taught since a child that they exist to protect our rights!!!! ;)

    How could you trust a government that leaves your left unprotected? :lol:
  • Reply 63 of 103
    calicali Posts: 3,494member
    dasanman69 wrote: »
    The company I work for handed out Motorola tablets recently. When I inquired about why weren't we getting iPads the answer I got was "nobody uses iPads anymore", and this was from a quite educated, and very tech savvy manager.

    haha I'd definitely question this guys "tech savvy".

    SLIGHTLY OFF TOPIC:

    Reminds me of an android fan I once knew. He thought he was the smartest guy in the world. His "tech savvy" was years beyond common man. He would often try to correct people about technology and thought everyone in the world was stupid except him. He would defend Giggle and MS to the death. He even contemplated buying a Zune!!

    Back in 2009 he said I was dumb because I bought an iMac and I could've put together a Windows PC. He had just bought a Windows PC the same year.

    Eventually I got sick of his sh** and schooled em in basic tech. He didn't know what 720p was. he didn't know what the "p" stood for. He didn't know what frames per second were. He was a big Microsoft fan so he was furious when I told him Halo was bought from Apple and Steve Jobs.

    Turns out he was full of it.

    oh and a few months later(2009) his new PC began crashing and his hard drive began burning.
    Today my 2009 iMac is still alive and humming!!
  • Reply 64 of 103
    sockrolidsockrolid Posts: 2,789member

    Originally Posted by AppleInsider View Post

    Android's looking a lot like Windows

     

    Yup.  And Google doesn't really care.  To Google, Android is just a mobile ad platform.

    97% of Google's revenue comes from ads.  Everything they do reflects that one fact.

     

    But anyway, let's shoot down a few boilerplate Android Apologist excuses:

     

    1. "You don't know what Android really is."

     

    Yes we do.  It's Google's mobile ad platform.  Oh, and Amazon has forked it into a mobile cash register.  Maybe some day Samsung will also fork Android, just so they can control their own destiny (and not rely on Tizen, which is horrible.  I've used it briefly.)

     

    There.  Now *you* know what Android really is.  Deal with it.

     

    2. "Open always wins."

     

    Depends on what you mean by the words "open," "always," and "wins."  If you mean "completely free and open source code will dominate in market share and profit share 100% of the time," then you've got some issues.  First, Android is not completely open source.  The AOSP versions of Google apps have been replaced one by one with closed source versions.  Search, Calendar, Gmail, the list keeps getting longer.

     

    What's that you say?  You say "Those are apps, not the kernel!  Yaaay opennnn!!!"

    Well guess what.  Put down your glittery open-source pom-poms and call up a would-be Android hardware maker.

    Ask them to create a fork of Android that really does conform to AOSP (Android Open Source Project).

    They'll tell you "Well, it would be pretty easy to port the kernel.  But creating our own version of all those apps will be a killer."

    But anyway, the OHA (Open Handset Alliance) goons would smack us down for not building Google-approved devices.

     

    For example, here's what happened to Acer when they tried to go open-source:

     

    "Google blocked Acer's rival phone to prevent 'fragmentation'

    http://arstechnica.com/gadgets/2012/09/google-blocked-acers-rival-phone-to-prevent-android-fragmentation/

     

    And here's Google bragging about shutting down Acer (with plenty of double-talk about "open source")

    http://officialandroid.blogspot.com/2012/09/the-benefits-importance-of-compatibility.html

     

    As for the word "wins," well pick your definition of "winning."  Market share?  Profit share?  

    From what I've heard, "market share" is the most important metric to any and all Android Apologists.

    And what does that mean, really?  To Android Apologists, it means "Android phone instead of an iPhone."

    In the real world, it means "Apple doesn't sell to the ultra-low-end market anyway.  Few if any lost sales."

     

    And in China, where the real "growth" of Android is happening, very few "activations" connect to Google Play.

    There are dozens if not hundreds of competing Android app stores of various repute throughout China.

    Zero benefit to Google.

     

    "App stores big source of mobile viruses"

    (and 300 competing Android app stores in China)

    http://www.bjd.com.cn/10beijingnews/business/201401/03/t20140103_5769014.html

     

    "10 App Stores in China You Ought to Be On"

    http://appflood.com/blog/top-10-alternative-app-stores-from-china-2013/

     

    "20 Android apps download store alternatives!"

    http://www.gizchina.com/2012/08/14/20-ways-to-get-free-android-apps-downloads/

     

    Oh, and as for profit share, Apple owns an "outrageous" share of all mobile profits:

    "Pie chart: Apple's outrageous share..."

    http://fortune.com/2010/09/21/pie-chart-apples-outrageous-share-of-the-mobile-industrys-profits/

     

    3. "Any day now, there will be a new awesome-r-ish Android release."

     

    Yeah.  Right.  We've been hearing that for years and years and years now.

    How's that Butter going?

    Did it help all those Android devices still running Gingerbread 2.3 scroll smoothly?  

    Finally?

    No?  They can't be updated?  

    Oh well.  Life in the big city yadda.

     

    Keep waiting.  Don't hold your breath.  The problem with copying Apple is that you need to wait for Apple to release something new so you have something to copy.  That forces your user base to wait until you've caught up.  Vicious cycle.

  • Reply 65 of 103
    You want privacy, security and reliability? Don't use Android or Windows%u2026
  • Reply 66 of 103
    calicali Posts: 3,494member
    dasanman69 wrote: »
    How could you trust a government that leaves your left unprotected? :lol:

    sarcasm and irony. ;)
    the conversation was about brainwashing.
  • Reply 67 of 103
    darklitedarklite Posts: 229member
    Quote:

    Originally Posted by SockRolid View Post

     

    2. "Open always wins."

     

    Depends on what you mean by the words "open," "always," and "wins."  If you mean "completely free and open source code will dominate in market share and profit share 100% of the time," then you've got some issues.  First, Android is not completely open source.  The AOSP versions of Google apps have been replaced one by one with closed source versions.  Search, Calendar, Gmail, the list keeps getting longer.

     


    As both Apple and Google have discovered, the best approach is neither completely open nor completely closed, but something in between (which is why their OSes are converging amid cries of 'omg stealing' from both sides). 

  • Reply 68 of 103
    elehcdnelehcdn Posts: 388member
    Quote:
    Originally Posted by NexusPhan View Post

     

    But I thought that one of the big advantages of running Android was not being locked into an eco-system. When the only source for apps is GooglePlay, doesn't that eliminate one of the big pluses DroidFans crow about?

     

    It is true that this hasn't been found in the wild, but now that it is publicized, how long before some unscrupulous developer jumps in on this? Sure Google has provided a fix, but it's mostly a CYA move - how successfully will it propagate down through the Android users?

     

    The only advantage that Androids have is that since each model is the newest and best, most of the older devices are now in a landfill or electronic recycling somewhere and aren't at risk ...

  • Reply 69 of 103
    singularitysingularity Posts: 1,328member
    Quote:

    Originally Posted by cali View Post





    haha I'd definitely question this guys "tech savvy".



    SLIGHTLY OFF TOPIC:



    Reminds me of an android fan I once knew. He thought he was the smartest guy in the world. His "tech savvy" was years beyond common man. He would often try to correct people about technology and thought everyone in the world was stupid except him. He would defend Giggle and MS to the death. He even contemplated buying a Zune!!



    Back in 2009 he said I was dumb because I bought an iMac and I could've put together a Windows PC. He had just bought a Windows PC the same year.



    Eventually I got sick of his sh** and schooled em in basic tech. He didn't know what 720p was. he didn't know what the "p" stood for. He didn't know what frames per second were. He was a big Microsoft fan so he was furious when I told him Halo was bought from Apple and Steve Jobs.



    Turns out he was full of it.



    oh and a few months later(2009) his new PC began crashing and his hard drive began burning.

    Today my 2009 iMac is still alive and humming!!

    I thought Bungie was an independent company that produced games primarily for the MAC before branching out to include windows, then MS after seeing HALO bought them for the original XBOX and werent owned by Apple or Jobs?

  • Reply 70 of 103
    dasanman69dasanman69 Posts: 13,002member
    elehcdn wrote: »
    But I thought that one of the big advantages of running Android was not being locked into an eco-system. When the only source for apps is GooglePlay, doesn't that eliminate one of the big pluses DroidFans crow about?

    It is true that this hasn't been found in the wild, but now that it is publicized, how long before some unscrupulous developer jumps in on this? Sure Google has provided a fix, but it's mostly a CYA move - how successfully will it propagate down through the Android users?

    The only advantage that Androids have is that since each model is the newest and best, most of the older devices are now in a landfill or electronic recycling somewhere and aren't at risk ...

    You can also get apps from Amazon. They only allow apps after vetting them.
  • Reply 71 of 103
    jexusjexus Posts: 373member
    Quote:

    Originally Posted by singularity View Post

     

    I thought Bungie was an independent company that produced games primarily for the MAC before branching out to include windows, then MS after seeing HALO bought them for the original XBOX and werent owned by Apple or Jobs?


    That's because you remember correctly.

    Bungie was never owned by Apple or Jobs. The reason Bungie was a prime Mac dev is because the Lead programmer, Jason Jones was most familiar with the Apple platform, having been raised on it.

     

    Halo was debuted at Macworld 1999, but a year later was acquired by Microsoft in full, thus making Halo a Microsoft IP for the foreseeable future and Bungie a Microsoft company until their split up a few years ago from Microsoft.

  • Reply 72 of 103
    Dan_DilgerDan_Dilger Posts: 1,583member
    Quote:

    Originally Posted by cnocbui View Post

     

     

    That's easy - DED would have been crowing about it from the rooftops instead of spreading FUD on his vegie patch.


     

     

    As the article clearly points out: the last time Bluebox pointed out a major design failing in Android's security architecture, there was malware in the wild within the month. 

     

    You lob personal attacks at the author, but the real issue is Google's sloppy work and the difficulty of fixing things in the "open paradise" that is Android. That, and the droid groupies who makes excuses for the company and its half baked products.

  • Reply 73 of 103
    dasanman69dasanman69 Posts: 13,002member
    I thought Bungie was an independent company that produced games primarily for the MAC before branching out to include windows, then MS after seeing HALO bought them for the original XBOX and werent owned by Apple or Jobs?

    That's about right. Apple showed a preview of HALO in 1999, but were bought by MS in 2000, which of course killed any Mac development. Btw Bungie has been independent again since 2007.
  • Reply 74 of 103
    Dan_DilgerDan_Dilger Posts: 1,583member
    Quote:
    Originally Posted by NexusPhan View Post

    Another fear mongering Apple Insider article. 


    Google scanned every app in it's official app store. Found no instances of this exploit.


     


    Google presumably also "scanned" its Android code and failed to realize that it wasn't even verifying app signing certificates. That's pretty basic PKI work.  


     


    Google updated automatically, behind the scenes every android device to add this exploit check to it's verify apps program.


     


    This isn't even remotely true. Google has started issuing some updates and patches via Google Play Services, but this happened all of twice this year. The last update is 5.0, from June 25. Check your phone to see if you have an update. You do not, because a new one hasn't been released yet.   


     


    In order to for this exploit to be used this is what has to happen:


    1. Go into security settings and enable third party app installation (off by default)


    2. Accept the warning saying not to do this.


    3. A developer will have to actually make an app that uses this exploit.


    4. The user will have to download this malicious new, theoretical app from a third party app store.


    5. User will have to accept a prompt asking if they want to install a third party app that could be potentially harmful.


    6. User will have to override the verify app warning that explicitly states that the app was found to be malicious (does it even let you???)


     


    Thanks for the tip. Google "how to sideload android software" and you get 1M responses. Are you so sure nobody has ever followed any of those?



    How about the "Android Central Sideload Wonder Machine" which Android Central promotes and tells its users: "It's a Windows program that can install applications you have downloaded outside the official Android Market to your Android phone."


     


    This is a non-issue. While it's never good to see a a security flaw, like is the case with every Android security flaw out there, Google has in place the necessary defenses.


     


    What a fantastically ignorant thing to say. So nobody sideloads Android apps, and the same company that doesn't know how to implement basic PKI cryptography for its users is a magical sky god that omnisciently protects all the peoples who buy cheap phones. 


     


    Except cheap phones like the Galaxy Nexus (and +80% of all Android phones actively accessing Google Play), which still carry those other serious vulnerabilities related to integrated Flash that pervade every app on the system. 


     


    ?Keep telling yourself that.


  • Reply 75 of 103
    ralphmouth wrote: »
    How do you fix the flaw on all those billions of Android phones that have been sold since 2010?

    This is the main difference between Android and iOS that the anti-iOS crowd ignores. Flaws and security breaches are found in both OSes all the time. However it is a lot easier to get the fix out to all the iOS devices. 

    Apple has the ability to also remotely kill and remove apps that get through the curation process and onto iDevices.

    Additionally, while both OSes could have flaws, and while a security breach is always possible, the possibility of it happening on iOS "all the time" is not true. That distinction is reserved for Android alone. Eventually one of the weaknesses in Android is going to mortally wound that platform.
  • Reply 76 of 103
    dasanman69dasanman69 Posts: 13,002member
    Eventually one of the weaknesses in Android is going to mortally wound that platform.

    Exaggerate much? As bad as XP was with malware and it didn't mortally wound Windows, why would anything hurt Android.
  • Reply 77 of 103
    dasanman69 wrote: »
    Eventually one of the weaknesses in Android is going to mortally wound that platform.

    Exaggerate much? As bad as XP was with malware and it didn't mortally wound Windows, why would anything hurt Android.

    One could also ask, "As good as Blackberry is, why would anyone chose any other Platform?" Android is weak, and run by a company who isn't profiting by having to babysit it. It's not a good combo and one of these days something will happen to wound it and it won't recover... jes say'n.
  • Reply 78 of 103
    dasanman69dasanman69 Posts: 13,002member
    One could also ask, "As good as Blackberry is, why would anyone chose any other Platform?" Android is weak, and run by a company who isn't profiting by having to babysit it. It's not a good combo and one of these days something will happen to wound it and it won't recover... jes say'n.

    Then what is a 'good combo' since you're jes say'n?
  • Reply 79 of 103
    Quote:
    Originally Posted by Corrections View Post

     

     

    I'm actually running version 5.0.84, but that's beside the point.  The point is that Google has averted most of the problem without a system update by updating its malware scanner in Google Play Services, which will roll out to the 99.3% of Android devices running on Gingerbread or later.  Of course your article wouldn't mention that because it doesn't have quite the same FUDdy ring to it.

     

    I should also say that patching the problem with a malware scanner update isn't as good as fixing the vulnerability outright, but it will be sufficient for the devices that won't receive the complete fix in an update to 4.4.5 or L (whichever ends up containing it).

  • Reply 80 of 103
    This is hilarious. I haven't posted here in so long, but Daniel or Mr. DED just posted at Ars Technica on its own version of the article.

    http://arstechnica.com/civis/viewtopic.php?f=2&t=1251045&p=27300557#p27300557

    Of course, Daniel failed to mention that AOSP is already patched here back in April:

    https://android.googlesource.com/platform/libcore/ /android-cts-4.1_r4


    and despite him saying Google won't fix it, already updated Google play services to detect apps that try to take advantage of the flaw for any handset or tablet, thus negating any issues for handsets that won't get updated, even though phones like the 2 generation old Samsung GS3 are running 4.4.2.

    And of course, Flash hasn't been in any Android device since 4.1.

    I guess in the years since I've been here, nothing has changed. DED still posts bull sht about Google and Android. And you guys fall for it every time.
Sign In or Register to comment.