First malware in the wild found exploiting Bluebox's Android app signing flaw

12467

Comments

  • Reply 61 of 124
    rjc999rjc999 Posts: 69member

    Quote:

    Originally Posted by d4NjvRzf View Post


     


    Interestingly, here is how Google explains its decision to request permissions at install time vs run time (http://source.android.com/devices/tech/security/index.html):


     


     


    Google seems to assume that users treat software purchases like business decisions.



     


    Both methods are flawed. Vista got criticized for the opposite issue, putting up authorization dialog everytime escalated privileges were needed. Security research has shown that both fall to "security fatigue", wherein eventually the user tunes out the content of these permission requests and just hits "Ok" There's no silver bullet. You can 100% sandbox apps and firewall them from other apps and the OS, but then users get irritated by duplication, because they entered something in another app (a contact) and can't pull it up in a different app and must reenter it. The more bells and whistles you add, the more "fine grained" the security mechanism, the more bewildering it becomes to end users as well, even though the most secure system has the finest grained permissions.

     0Likes 0Dislikes 0Informatives
  • Reply 62 of 124

    Quote:

    Originally Posted by rjc999 View Post


    Don't hold back DED, tell us how you really feel. 



    "Let the hate flow through you"

     0Likes 0Dislikes 0Informatives
  • Reply 63 of 124
    alfiejralfiejr Posts: 1,524member

    Quote:

    Originally Posted by d4NjvRzf View Post


    Sure it's Open in the sense that anyone can use the AOSP code. But the code does not come with any support. The primary benefit of open source is to reduce duplication of labor. A company which uses the AOSP codebase does not need to write its own kernel. But it's that company's responsibility to incorporate the latest upstream patches into its project.



    i was being lighthearted of course with "It's Open." but not this time: Google can't wash it's hands of the monster it created - got it?

     0Likes 0Dislikes 0Informatives
  • Reply 64 of 124
    alfiejralfiejr Posts: 1,524member

    Quote:

    Originally Posted by Corrections View Post


     


    Nothing. Just like the Chinese can electrocute themselves with their own faulty knockoff power adapters.


     


    The point, however, is that in both cases the iOS device is not being used as its designed to be used.


     


    Android is designed to sideload apps from any source; the fact that its core OS fails to flag signing problems is transient issue (but hard to fix). The larger problem is that virtually every serious difference in Android, compared to iOS, a flaw. Google created an insecure platform under the guise of being open. It ignored risks and is now left with a mess of issues. Beyond that, Google's design for permissions invites abuse of users' privacy and security. So even without the bugs, Android has a core design flaws. It's not designed to be good, it's designed to propagate ads ad collect market data.



    precisely.

     0Likes 0Dislikes 0Informatives
  • Reply 65 of 124
    Dan_Dilgerdan_dilger Posts: 1,584member

    Quote:

    Originally Posted by d4NjvRzf View Post


     


    Interestingly, here is how Google explains its decision to request permissions at install time vs run time (http://source.android.com/devices/tech/security/index.html):


     


     


    Google seems to assume that users treat software purchases as business decisions.



     


    Hows that working out? Lots of professional respect for the clusterfuck of Android? What can one say about the platform, apart from "it helps cheap devices ship that might otherwise be to terrible to support commercial software"?


     


    How's the user satisfaction ratings by regular Android users? And not just the ideologically devoted. Seems most people use Android for MyFirstSmartphone training wheels and then get a real iPhone afterward. There's little movement toward Android from the other direction, if you look at research rather than just surveying your self-selected friends.

     0Likes 0Dislikes 0Informatives
  • Reply 66 of 124
    Dan_Dilgerdan_dilger Posts: 1,584member

    Quote:

    Originally Posted by LAKings33 View Post


    "Let the hate flow through you"



     


    I don't hate anything in technology, apart from incompetence itself and those who troll in support of it. 


     


    Google is wasting a lot of money but I certainly don't hate the company. I use several Google products and they bought me a nice car. 

     0Likes 0Dislikes 0Informatives
  • Reply 67 of 124
    d4njvrzfd4njvrzf Posts: 797member

    Quote:

    Originally Posted by Alfiejr View Post


    i was being lighthearted of course with "It's Open." but not this time: Google can't wash it's hands of the monster it created - got it?



    I doubt Google is that interested in washing its hands. To Google, those Chinese forks might as well not exist.

     0Likes 0Dislikes 0Informatives
  • Reply 68 of 124
    Dan_Dilgerdan_dilger Posts: 1,584member

    Quote:

    Originally Posted by rjc999 View Post


     


    Both methods are flawed. Vista got criticized for the opposite issue, putting up authorization dialog everytime escalated privileges were needed. Security research has shown that both fall to "security fatigue", wherein eventually the user tunes out the content of these permission requests and just hits "Ok" There's no silver bullet. You can 100% sandbox apps and firewall them from other apps and the OS, but then users get irritated by duplication, because they entered something in another app (a contact) and can't pull it up in a different app and must reenter it. The more bells and whistles you add, the more "fine grained" the security mechanism, the more bewildering it becomes to end users as well, even though the most secure system has the finest grained permissions.



     


    Yes Vista's throwing up nonsense messages ad nauseam is not better than Google's EULA style "take it or leave it bullshit agreement before you install an app" nonsense.


     


    But let's talk non-nonsense. Is there anything better than the iOS app store restricting app developers from doing terrible things, and making them ask for permission before recording, accessing location, contacts, etc? Seems like the right balance to me. 

     0Likes 0Dislikes 0Informatives
  • Reply 69 of 124
    Dan_Dilgerdan_dilger Posts: 1,584member

    Quote:

    Originally Posted by rjc999 View Post


    Don't hold back DED, tell us how you really feel. 



     


    Thanks for removing the overboard and deranged part of your rant. 


     


    Also, please just keep your comments on topic and relevant. You can argue any point you like, just let up on the hysterics and bad behavior. Engage in an adult conversation. 

     0Likes 0Dislikes 0Informatives
  • Reply 70 of 124
    d4njvrzfd4njvrzf Posts: 797member

    Quote:

    Originally Posted by Corrections View Post


     


     


    But let's talk non-nonsense. Is there anything better than the iOS app store restricting app developers from doing terrible things, and making them ask for permission before recording, accessing location, contacts, etc? Seems like the right balance to me. 



    How about also informing the users before they hit "buy"? Does the app store let users get a refund if they discover only after running an app that it wants access to their personal info and won't function optimally otherwise?

     0Likes 0Dislikes 0Informatives
  • Reply 71 of 124
    alfiejralfiejr Posts: 1,524member

    Quote:

    Originally Posted by d4NjvRzf View Post


    I doubt Google is that interested in washing its hands. To Google, those Chinese forks might as well not exist.



    yup. and also all of the real Chinese people it can't data-mine.

     0Likes 0Dislikes 0Informatives
  • Reply 72 of 124
    3eleven3eleven Posts: 87member


     0Likes 0Dislikes 0Informatives
  • Reply 73 of 124
    Hows that working out? Lots of professional respect for the clusterfuck of Android? What can one say about the platform, apart from "it helps cheap devices ship that might otherwise be to terrible to support commercial software"?

    How's the user satisfaction ratings by regular Android users? And not just the ideologically devoted. Seems most people use Android for MyFirstSmartphone training wheels and then get a real iPhone afterward. There's little movement toward Android from the other direction, if you look at research rather than just surveying your self-selected friends.

    Seems Google is heading this way http://www.androidpolice.com/2013/07/25/app-ops-android-4-3s-hidden-app-permission-manager-control-permissions-for-individual-apps/

    The 4.3 update apparently lets you switch off the permissions you don't want the app to access.

    Thanks DeD. Your rambling is changing Android for the better :)
     0Likes 0Dislikes 0Informatives
  • Reply 74 of 124
    Dan_Dilgerdan_dilger Posts: 1,584member

    Quote:

    Originally Posted by d4NjvRzf View Post


    How about also informing the users before they hit "buy"? Does the app store let users get a refund if they discover only upon running an app that it wants access to their personal info and won't function optimally otherwise?



     


     


    Apps that demand access to your contacts and refuse to work otherwise don't get approved. That's what the whole curation thing is about. 


     


    Have you ever used the App Store? It's not just a bunch of garbage adware like Google Play. You should check it out and see why there's such a vast difference in how iOS users buy apps compared to the situation that awaits Android buyers. It's hard to even compare.


     


    When I look at Google Play I don't even understand how the company has fans, let alone the zombie horde of missionaries that set up camp and attack every article I write about how appallingly bad the Android experience really is. What drives your devotion to sloppy software and poor planning, mr sklgjskkdls?

     0Likes 0Dislikes 0Informatives
  • Reply 75 of 124
    koopkoop Posts: 337member

    Quote:

    Originally Posted by Corrections View Post


     


    You can keep telling yourself that malware and spyware has no impact on the platform, but that didn't work out well for Windows XP did it? 


     


    The only difference here is that Microsoft's malware problem trumped its vast advantage in third party developer support over Macs.


    Android is a hobbyist platform that doesn't have an advantage of any sort. iOS has the advantage, but Android has the malware. 


     


    I wonder how that's going to work out.



     


    The only difference is one Malware problem is real and the other perceived. I'll let you guess which one is which.


     


    And that darn hobbyist platform is doing awfully well for itself. 

     0Likes 0Dislikes 0Informatives
  • Reply 76 of 124
    Wow this sounds like a nasty virus https://discussions.apple.com/thread/4895878?start=0&tstart=0

    The guy can't even use Safari. With Android at least you can choose which browser to use automatically so he could at least circumvent the adware. Sucks for him... I guess if malware was to become widespread on iOS it could do SERIOUS damage versus on Android that is designed in a way that has safeguards in place.
     0Likes 0Dislikes 0Informatives
  • Reply 77 of 124
    d4njvrzfd4njvrzf Posts: 797member

    Quote:

    Originally Posted by Corrections View Post


     


     


    Apps that demand access to your contacts and refuse to work otherwise don't get approved. That's what the whole curation thing is about. 


    [...]


     


    When I look at Google Play I don't even understand how the company has fans, let alone the zombie horde of missionaries that set up camp and attack every article I write about how appallingly bad the Android experience really is. What drives your devotion to sloppy software and poor planning, mr sklgjskkdls?



    You misread my post as a defense for Google. Some people probably try apps as they might sample food at a buffet, and declaring permissions at install time obviously won't make much of an impression on those people. But others might prefer to know exactly what they are getting before they buy something, not just that someone else deems the app "acceptable". That's why I included the word "also." Informing the user at install time need not involve putting up a dialog box. For example, Apple could simply require apps to declare their intention to access contacts in their app store descriptions. 

     0Likes 0Dislikes 0Informatives
  • Reply 78 of 124

    Quote:

    Originally Posted by Corrections View Post


     


    I don't hate anything in technology, apart from incompetence itself and those who troll in support of it. 



    You might claim not to hate anything in technology, but you certainly spend enough time focusing on topics that encourage hate.


     


    You'll cover a malware 'outbreak' on Android, but you won't spend time on something such as Ubuntu Edge (http://www.indiegogo.com/projects/ubuntu-edge). A device that strives for innovation, a benefit to all mobile consumers.


     


    When asked by an iOS user about the Ubuntu Edge, Mark Shuttleworth had this to say: "the Edge is a very interesting new way to signal to Apple what you consider cool in hardware (and software)." (http://www.reddit.com/r/IAmA/comments/1j166z/hi_im_mark_shuttleworth_founder_of_ubuntu/)


     


    --


     


    What about software innovation such as OpenGL ES 3.0? Android, not iOS, is the one making the push. There are over 30 Android devices currently on the market that offer hardware support for OpenGL ES 3.0, meanwhile Apple doesn't have a single iOS device on the market capable of utilizing OpenGL ES 3.0. The first game to use OpenGL ES 3.0 features will be launching early August, Asphalt 8. Unity 4.2, the newest edition to a very popular game engine, will be offering GLES3 support for Android.

     0Likes 0Dislikes 0Informatives
  • Reply 79 of 124
    droidftwdroidftw Posts: 1,009member

    Quote:

    Originally Posted by mrrodriguez View Post



    Wow this sounds like a nasty virus https://discussions.apple.com/thread/4895878?start=0&tstart=0



    The guy can't even use Safari. With Android at least you can choose which browser to use automatically so he could at least circumvent the adware. Sucks for him... I guess if malware was to become widespread on iOS it could do SERIOUS damage versus on Android that is designed in a way that has safeguards in place.


     


    Not sure I'd call that a virus, but that would be frustrating as heck to have to deal with that.  It sounds like that guy needs an ad blocker.  Apparently it's really easy to do on an iDevice.  Earlier in this thread GTR posted that all you have to do is "Press the button at the top of the browser that says 'Reader'." to block ads.  I wonder why no one suggested that instead of dismissing their problems or suggesting they do things they've already tried.

     0Likes 0Dislikes 0Informatives
  • Reply 80 of 124
    alfiejralfiejr Posts: 1,524member

    Quote:

    Originally Posted by koop View Post


     


    The only difference is one Malware problem is real and the other perceived. I'll let you guess which one is which.


     


    And that darn hobbyist platform is doing awfully well for itself. 



    gee, you must have missed my post not too far above on this page 2 ...


     


     


    "... to see the real world outcome of that vulnerability, let me direct your attention to some hard facts reported by no less than Android Authority:


     


    http://www.androidauthority.com/1-4-million-real-malware-infections-204748/


     


    it reports that NQ Mobile has reported that in 2012 about 11.5 million Android phone worldwide had "real" malware - 1.1 million of which are in the USA! (they screwed up their math and report a higher number of 1.4 million, but hey, it's an droid fan site so ...). 25% of the total was in China, 20% India, 18% Russia, 10% Saudia Arabia and USA ...


     


    and this total was triple 2011's. how do you think it's going this year?"


     


    ... sounds kinda real to me. that's ok, i don't read all the comments before posting either.

     0Likes 0Dislikes 0Informatives
Sign In or Register to comment.