First malware in the wild found exploiting Bluebox's Android app signing flaw

12357

Comments

  • Reply 81 of 124
    alfiejralfiejr Posts: 1,524member

    Quote:

    Originally Posted by 3Eleven View Post




    problem is, the damn f*cker just won't stay dead.

  • Reply 82 of 124
    koopkoop Posts: 337member

    Quote:

    Originally Posted by Alfiejr View Post


    gee, you must have missed my post not too far above on this page 2 ...


     


     


    "... to see the real world outcome of that vulnerability, let me direct your attention to some hard facts reported by no less than Android Authority:


     


    http://www.androidauthority.com/1-4-million-real-malware-infections-204748/


     


    it reports that NQ Mobile has reported that in 2012 about 11.5 million Android phone worldwide had "real" malware - 1.1 million of which are in the USA! (they screwed up their math and report a higher number of 1.4 million, but hey, it's an droid fan site so ...). 25% of the total was in China, 20% India, 18% Russia, 10% Saudia Arabia and USA ...


     


    and this total was triple 2011's. how do you think it's going this year?"


     


    ... sounds kinda real to me. that's ok, i don't read all the comments before posting either.



     


    If you read the report, it actually didn't increase in the USA from 2011 to 2012, just in other countries. So yes, less than 2% of all Android phones in the United States most likely have some form of malware on it that specializes in stealing data. The report cites (and this is new) that people who sideload and use application vendors outside of Google Play are most likely the ones infected. The report cites that mostly a younger generation of users who do this. 


     


    So lets do some math.


     


    Young People + Sideloading outside applications = Pirating. Yup. Bobby and Sarah at your local University live off ramen and probably pirate Doodle Jump when they should be studying. 


     


    Before I switch gears I also wanted to note the irony of the Google Play store logo as the front page picture for this story, as Google Play is the default App store and isn't affected by this issue.


     


    --


     


    But to be fair, I have an iPhone because I enjoy getting my updates the moment Apple releases them. It's an incredible feature, however: 


     



    • I give Android leeway in some of these issues because Google cannot make OEM's and Wireless Carriers certify and release updates.


    • Google is remedying this problem by slowing down the pace of their OS updates. Jelly Bean is a slow moving creature these days, getting incremental updates. Slowly the pie chart will fill out with mostly Jelly Bean devices.


    • Google's Android OS has been the faster improving Mobile OS. It's seen some incredible jumps in interface and features over the past four years. Many lower end devices just got left behind. iOS in contrast has been incremental.


     


    If we are having a debate where you said to me "iOS is more secure than Android", it wouldn't be much of a debate because I agree. But I don't believe we're in an epidemic of Android malware. The default setup of Android is secure, and allows people to own a phone with larger screens, different types of battery life and whatever customization they want. Every single article about Android malware always has a stipulation where people turn off some key settings in their phone to get it to install. That's just not scary, and it's not worth sounding the alarms. Get back to me when malware installs through Google Play or you just turn the phone on and infections spring up. 

  • Reply 83 of 124
    caliminiuscaliminius Posts: 944member


    I see my comment about calling out the author making stuff up was deleted. The author states that the Android Facebook app was harvesting a user's entire phone book. He then links to an article he himself wrote that says the Facebook app was actually only transmitting the user's phone number. Granted, that's still not great but it's not the sensationalist "harvesting a user's entire phone book" claim stated in the article.


     


    I shall henceforth accept everything Dilger writes as the gospel truth, no matter how inaccurate, biased, or cherry-picked the information may be.


     


    I deeply apologize for calling out the author's blatant lies.

  • Reply 84 of 124
    gatorguygatorguy Posts: 24,213member
    Yes Vista's throwing up nonsense messages ad nauseam is not better than Google's EULA style "take it or leave it bullshit agreement before you install an app" nonsense.

    But let's talk non-nonsense. Is there anything better than the iOS app store restricting app developers from doing terrible things, and making them ask for permission before recording, accessing location, contacts, etc? Seems like the right balance to me. 

    Then you will certainly like Google's improvements in permissions coming with Android 4.3.

    Not only does it list the permissions before you install the app as Android has for some time, it will also allow specific permissions to be denied within specific apps. The right balance just like you said.
    http://www.engadget.com/2013/07/26/hidden-permissions-manager-android-4-3/
  • Reply 85 of 124
    MarvinMarvin Posts: 15,322moderator
    caliminius wrote: »
    I see my comment about calling out the author making stuff up was deleted. I shall henceforth accept everything Dilger writes as the gospel truth, no matter how inaccurate, biased, or cherry-picked the information may be.

    You don't have to accept the article but you do have to avoid insulting the author. Insulting article authors is treated the same as insulting other forum members.
  • Reply 86 of 124
    macrulezmacrulez Posts: 2,455member

    Quote:

    Originally Posted by Marvin View Post





    You don't have to accept the article but you do have to avoid insulting the author. Insulting article authors is treated the same as insulting other forum members.




    Does that apply equally to authors who don't also have accounts here?

  • Reply 87 of 124
    MarvinMarvin Posts: 15,322moderator
    macrulez wrote: »
    Marvin wrote: »
    You don't have to accept the article but you do have to avoid insulting the author. Insulting article authors is treated the same as insulting other forum members.

    Does that apply equally to authors who don't also have accounts here?

    It applies to every author.
  • Reply 88 of 124
    derekmorrderekmorr Posts: 237member

    Quote:

    Originally Posted by Marvin View Post





    You don't have to accept the article but you do have to avoid insulting the author. Insulting article authors is treated the same as insulting other forum members.


     


    Then why aren't more posts deleted, like say, most things by Apple ][ ?

  • Reply 89 of 124
    Seems like Google just found a way to cover 95% of devices with a hidden update http://m.blogs.computerworld.com/android/22552/google-android-security?mm_ref=http://plus.url.google.com/mobileapp
  • Reply 90 of 124
    relicrelic Posts: 4,735member
    Seems like Google just found a way to cover 95% of devices with a hidden update http://m.blogs.computerworld.com/android/22552/google-android-security?mm_ref=http://plus.url.google.com/mobileapp

    It doesn't matter, if it isn't Apple it will be crucified on this board, regardless. These articles are posted here to incite the dark side in human nature and not to actually have an intellectual conversation on the technology. Just continual shots over the bow of any and all, either your with us or against us, mine is better then yours and all that malarkey. I personally use all sorts of gizmos and technology from all walks of the spectrum, I take zero sides as I find value in all. I'm just so amazed and in awe that I live in such a time where things like smart phones and tablets are possible. Preferences in platform or especially vulnerabilities, don't really get my juices flowing, what is possible with said tech does.
  • Reply 91 of 124
    MarvinMarvin Posts: 15,322moderator
    derekmorr wrote: »
    Marvin wrote: »
    You don't have to accept the article but you do have to avoid insulting the author. Insulting article authors is treated the same as insulting other forum members.

    Then why aren't more posts deleted, like say, most things by Apple II?

    If members have insulted the article authors, flag the posts but don't just flag posts of other members you don't like for the sake of it. Some people have a habit of doing that. As long as people keep the discussion on-topic, don't use offensive generalisms about the forum or its members and don't attack the people making the comments but rather what they say, they are complying with the rules.
  • Reply 92 of 124
    Dan_DilgerDan_Dilger Posts: 1,583member

    Quote:

    Originally Posted by LAKings33 View Post


    You might claim not to hate anything in technology, but you certainly spend enough time focusing on topics that encourage hate.


     


    You'll cover a malware 'outbreak' on Android, but you won't spend time on something such as Ubuntu Edge (http://www.indiegogo.com/projects/ubuntu-edge). A device that strives for innovation, a benefit to all mobile consumers.


     


    When asked by an iOS user about the Ubuntu Edge, Mark Shuttleworth had this to say: "the Edge is a very interesting new way to signal to Apple what you consider cool in hardware (and software)." (http://www.reddit.com/r/IAmA/comments/1j166z/hi_im_mark_shuttleworth_founder_of_ubuntu/)


     


    --


     


    What about software innovation such as OpenGL ES 3.0? Android, not iOS, is the one making the push. There are over 30 Android devices currently on the market that offer hardware support for OpenGL ES 3.0, meanwhile Apple doesn't have a single iOS device on the market capable of utilizing OpenGL ES 3.0. The first game to use OpenGL ES 3.0 features will be launching early August, Asphalt 8. Unity 4.2, the newest edition to a very popular game engine, will be offering GLES3 support for Android.



     


    So every time an article is written about Samsung and Apple, there's complaints about AI being "Samsung Insider!!!" But when some inconsequential hobbyist Linux distro which has released a series of initiatives that have never gone anywhere, does a kickstarter for an extreme niche Linux smartphone concept that has no relevance to Apple and its users whatsoever, it's something AI should be covering in detail.


     


    I think you're thinking of LinuxInsider. Why don't you go there and talk about it?  

  • Reply 93 of 124
    macrulezmacrulez Posts: 2,455member

    Quote:

    Originally Posted by Marvin View Post





    If members have insulted the article authors, flag the posts...


    At least three posts suggesting that button have been deleted.  It'll be interesting to see how long yours remains.

  • Reply 94 of 124
    relicrelic Posts: 4,735member
    lakings33 wrote: »
    You might claim not to hate anything in technology, but you certainly spend enough time focusing on topics that encourage hate.

    You'll cover a malware 'outbreak' on Android, but you won't spend time on something such as Ubuntu Edge (<a href="http://www.indiegogo.com/projects/ubuntu-edge" style="line-height:1.231;" target="_blank">http://www.indiegogo.com/projects/ubuntu-edge</a>;
    ). A device that strives for innovation, a benefit to all mobile consumers.

    When asked by an iOS user about the Ubuntu Edge, Mark Shuttleworth had this to say: "<span style="font-family:verdana, arial, helvetica, sans-serif;font-size:small;line-height:normal;">the Edge is a very interesting new way to signal to Apple what you consider cool in hardware (and software)." (</span>
    <a href="http://www.reddit.com/r/IAmA/comments/1j166z/hi_im_mark_shuttleworth_founder_of_ubuntu/" style="line-height:1.231;" target="_blank">http://www.reddit.com/r/IAmA/comments/1j166z/hi_im_mark_shuttleworth_founder_of_ubuntu/</a>;
    )

    --

    What about software innovation such as OpenGL ES 3.0? Android, not iOS, is the one making the push. There are over 30 Android devices currently on the market that offer hardware support for OpenGL ES 3.0, meanwhile Apple doesn't have a single iOS device on the market capable of utilizing OpenGL ES 3.0. The first game to use OpenGL ES 3.0 features will be launching early August, Asphalt 8. Unity 4.2, the newest edition to a very popular game engine, will be offering GLES3 support for Android.


    Isn't that the coolest phone you have ever seen, not just talking looks here but what canonical envisions the workflow to be like. My biggest dream is to have one device that does it all and it just might be that my dream will come to light. I was one of the first to pledge for this project, I sure hope it becomes a reality.
  • Reply 95 of 124
    Dan_DilgerDan_Dilger Posts: 1,583member

    Quote:

    Originally Posted by mrrodriguez View Post



    Seems like Google just found a way to cover 95% of devices with a hidden update http://m.blogs.computerworld.com/android/22552/google-android-security?mm_ref=http://plus.url.google.com/mobileapp


     


     


    Did you read the article? How is Google going to scan apps on the devices that never plug into Google Play, the very users at risk here? 


     


    Or were you just impressed that this guy from "Android Power" (I'm not making that up) assured you that there's no problem and nobody should even be talking about any of these problems that are being uncovered.


     


    Why are Android fans like this blogger so into censorship and so opposed to open information and free speech?  

  • Reply 96 of 124

    Quote:

    Originally Posted by Corrections View Post


     


    So every time an article is written about Samsung and Apple, there's complaints about AI being "Samsung Insider!!!" But when some inconsequential hobbyist Linux distro which has released a series of initiatives that have never gone anywhere, does a kickstarter for an extreme niche Linux smartphone concept that has no relevance to Apple and its users whatsoever, it's something AI should be covering in detail.


     


    I think you're thinking of LinuxInsider. Why don't you go there and talk about it?  



    Clearly you didn't bother to read or take the time looking into why the device is being made. How the technology being used will likely end up on a future Apple iOS device. No mobile technology enthusiast should be against this device.


     


    You also completely ignored my mention of OpenGL ES 3.0, something that will eventually come to Apple iOS devices when they start using PowerVR Series 6 GPUs.

  • Reply 97 of 124
    Dan_DilgerDan_Dilger Posts: 1,583member

    Quote:

    Originally Posted by Gatorguy View Post





    Then you will certainly like Google's improvements in permissions coming with Android 4.3.



    Not only does it list the permissions before you install the app as Android has for some time, it will also allow specific permissions to be denied within specific apps. The right balance just like you said.

    http://www.engadget.com/2013/07/26/hidden-permissions-manager-android-4-3/


     


    That's great, a major improvement. It's taken directly from iOS, isn't it? Which is fine, there doesn't seem to be anything (that should be) patented here. 


     


    Now, given that we all agree that Android following iOS's security best practices is great, can we also agree that when Android blows out some feature (like say, app switching or a notification page) before Apple releases its own version of the same thing, and which it has clearly been working on for years, we don't have to listen to Android fans talking about how Apple "stole" such incremental features from Google? 


     


    I hope you agree. Thanks.

  • Reply 98 of 124
    relicrelic Posts: 4,735member

    How is Google going to scan apps on the devices that never plug into Google Play, the very users at risk here? 

    That's silly, that would mean the user never uses the device with the internet or they sideload all apps in which case it's a waste of time because they'll have to hunt down all of the individual apk's. If you have apps, your using Google Play, maybe not for everything but even sideloaded apps are registered in Google Play upon installation unless it's a custom app, your reaching here.
  • Reply 99 of 124
    gatorguygatorguy Posts: 24,213member
    That's great, a major improvement. It's taken directly from iOS, isn't it? Which is fine, there doesn't seem to be anything (that should be) patented here. 

    Now, given that we all agree that Android following iOS's security best practices is great, can we also agree that when Android blows out some feature (like say, app switching or a notification page) before Apple releases its own version of the same thing, and which it has clearly been working on for years, we don't have to listen to Android fans talking about how Apple "stole" such incremental features from Google? 

    I hope you agree. Thanks.

    Yes I do.
  • Reply 100 of 124
    macrulezmacrulez Posts: 2,455member

    Quote:

    Originally Posted by Corrections View Post


    So every time an article is written about Samsung and Apple, there's complaints about AI being "Samsung Insider!!!" But when some inconsequential hobbyist Linux distro which has released a series of initiatives that have never gone anywhere, does a kickstarter for an extreme niche Linux smartphone concept that has no relevance to Apple and its users whatsoever, it's something AI should be covering in detail.



    Actually, Ubuntu Edge has at least four ways it may be relevant here:


     


    1. Its design is a radical departure from iOS and Android, arguably making better use of screen space by not having always-present elements like the notification bar.  During this period in which Apple is exploring ways to simplify their design, the Ubuntu team's initiatives may provide some guidance, or at least counterpoint to support iOS' direction.


     


    2. As an OS designed to work across all device types, from mobile to the desktop to TVs, Ubuntu challenges Apple's dual-OS strategy, with a much more cohesive design than Microsoft's.


     


    3. Ubuntu is the third most popular desktop OS in the world, with more users today than Apple had when Steve returned.  To dismiss them without examination risks missing what could well be one of the most promising competitors Apple's had in years.  If nothing else, Canonical's budding relationships with Chinese carriers, not to mention China standardizing on an Ubuntu fork, may boost it in an important market where Apple is losing ground.


     


    4. Almost any reasonable person would admit the specs on the Edge are pretty impressive.


     


    Sure, on the desktop both Apple and Ubuntu are niche players in a world where Microsoft still controls almost 90% of the market, and whether Ubuntu gets any significant traction in mobile remains to be seen.


     


    But viewed against the rather constant stream of anti-Google/anti-Samsung/anti-Microsoft/anti-Nokia/anti-EnemyDuJour articles here, there's little argument to be made that it's not at least as relevant as a good many of them.

Sign In or Register to comment.