Google Has Android Remote App Install Power, Too

Trailrunner7 writes "The remote-wipe capability that Google recently invoked to remove a harmless application from some Android phones isn't the only remote control feature that the company built into its mobile OS. It turns out that Android also includes a feature that enables Google to remotely install apps on users' phones as well. Jon Oberheide, the security researcher who developed the application that Google remotely removed from Android phones, noticed during his research that the Android OS includes a feature called INSTALL_ASSET that allows Google to remotely install applications on users' phones. 'I don't know what design decision they based that on. Maybe they just figured since they had the removal mechanism, it's easy to have the install mechanism too,' Oberheide said in an interview. 'I don't know if they've used it yet.'"

Comments

They also removed the restraining bold from C3PO

[Anonymous Coward]

Google has been taken over by Jawas.

kinda scary

[grapeape]

So how long until we see someone attempt to exploit this?

Re:kinda scary

[FooAtWFU]

How long until someone exploits this? Well, I bet Google or some other vendor will try to sell it as part of an offering for businesses within the next 2 years. Remote software installs would be very useful in the enterprise.

Re:kinda scary

[MrNaz]

I think that remote anything should be opt-in by the user, or, in an enterprise setting, should be added on by the enterprise before distributing the units. I do not welcome the idea that *all* Android handsets will have remote add/remove package functionality out of the box, for all users.

Imagine the fun law enforcement and government agencies will have with this. Remote install app that silently forwards mic input to an eavesdropper.

Is there even a way to turn this feature off? I.e., lets say I buy a handset and I definitely do *not* want Google nuking my apps remotely or adding apps to my phone remotely without my knowledge.

This is the reason that I think the FOSS community should back MeeGo. It's the only *true* open source system out there that's open enough that the Many Eyeballs principle can be applied to, and that is open enough that we'll eventually see custom distros of the OS emerging.

Re:kinda scary

[Anonymous Coward]

Imagine the fun law enforcement and government agencies will have with this. Remote install app that silently forwards mic input to an eavesdropper.

Then they can remote install some kiddy porn images so they have excuse to raid his house and confiscate all his computer equipment.

Re:kinda scary

[AnAdventurer]

I am working one it. Just one more line of code, almost there.

Re:kinda scary

[gregor-e]

An exploit for remote app installs should come about as soon as an exploit for the automatic OS update feature. Chances are good they both use similar protections.

Re:kinda scary

[rwa2]

Meh, they have that kind of software for almost all phones. http://flexispy.com/ and plenty others, I'm sure.

I suppose it might be nefarious that they don't even need physical access to your phone to install it. But the install feature probably asks for user confirmation before receiving a "push" install from your carrier, just like my cheap Samsung dumbphone.

If you really want control, I suppose you could put http://www.cyanogenmod.com/ on your Android phone. Is that affected?

Re:kinda scary

[MobileTatsu-NJG]

I am working one it. Just one more line of code, almost there.

I like to lick butts!

Re:kinda scary

[MobileTatsu-NJG]

Wait! I didn't post that!!

Re:kinda scary

[MikeDaSpike]

Not to mention, google already announced you will be using this feature before. If you haven't seen this years google I/O then I'll tell you: you will be able to install apps on your phone from any device in the cloud.

And besides, it's not like google is targeting you specificaly, they target all phones with that app installed. The purpose of it is to remove a malicious app before it can do any more damage.

Example: I make an app branded as a porn site viewer, it works as one but it also sends information gathered from your sdcard/phone for some nefarious deeds. Removing it from the market would stop the app from spreading, but it has already been installed on thousands of phones, setting a flag on the market for "uninstall from phone NOW" would fix this.

I know google could be more gentle about it and warn the user and ask for the app to be removed, but it's not like they use it on every app that pisses them, only on those that disregard their stated rules. So far google has been following the rules, so articles like this are just spreading FUD.

Re:kinda scary

[TheRaven64]

@MikeDaSpike

This is not twitter. We can tell that you are replying to MikeDaSpike because you pressed the Reply to This button under his post and so your post shows up in the thread below his.

Re:kinda scary

[fishexe]

It's the only *true* open source system out there that's open enough that the Many Eyeballs principle can be applied to, and that is open enough that we'll eventually see custom distros of the OS emerging.

Although I get your point, I'd say the Many Eyeballs principle is working with Android, given that this article exists.

Re:kinda scary

[badpazzword]

Quoting the grandparent:

"Google already announced ... you will be able to install apps on your phone from any device in the cloud."

Re:kinda scary

[mestar]

How does an off-topic reply that misses the point of the topic totally get modded "interesting" ?

Being wrong and being interesting often go together. Look at all the physics crackpots. Or politicians.

Re:kinda scary

[Lemming Mark]

MeeGo also has the advantage of not reinventing the entire userspace, thus remaining closer to what we generally consider a GNU/Linux system. Android is quite slick in practice but it does upset me that it's so non-standard in every possible way :-(

Re:kinda scary

[JaredOfEuropa]

I think that remote anything should be opt-in by the user, or, in an enterprise setting, should be added on by the enterprise before distributing the units

Remote install will be a great help in managing corporate applications; if you leave installing updates to the users, you'll have a nightmare on your hands if you want/have to keep all versions the same.

Opt-in is a good idea, though. I like how that works on the iPhone; we get access to our corporate email and calendar on private iPhones by means of a certificate, which enforces a few things like requiring a pin lock on the phone. Removing the certificate or the pin lock is still possible, but you'll lose access to the corporate server when you do (and locally stored company emails are deleted). In the same way you could allow the company to install or update apps on your phone... even when it's a privately owned one.

Re:kinda scary

[Rich0]

Yup, the owner of the phone should have a number of options:

1. Disable remote install / remote wipe / force password / etc.
2. Do #1, but also report to REMOTE-ENTITY that all of the above are enabled and working fine.
3. Grant access to REMOTE-ENTITY to do remote install/wipe/etc.

If an employer wants to give somebody a phone on their dime they should have the right to manage it as they see fit. If I want to check my work email from a phone that I own then my employer should not have this kind of power. The problem is that some employers will just make employees do this anyway - lots of people at work have been whining about having to type in n-digit PINs every time they want to use their phone.

Looks like it is time to write an open-source exchange client, with debug-only features like changing whatever is the equivalent of user_agent and the capabilities bits reported to the server, and separate features that actually enable or disable those capabilities. Go ahead and release it for every major phone OS and employers will rethink their approach....

Re:kinda scary

[Anonymous Coward]

So far google has been following the rules, so articles like this are just spreading FUD.

That's the stupidest thing I've read all week. If I unexpectedly have access to your identity, do you really take any great comfort from the weak assumption that I've not raided it yet, as far as you know?

Re:kinda scary

[Anonymous Coward]

You might just find that employers will stop offering OTA Exchange. In our environment we'd have to by law, if we couldn't assure that should a device be lost, the data on it is removed.

Re:kinda scary

[bwintx]

Perhaps you should be more worried that (at least when I'm seeing this) it also got that comment modded as "5, Informative"; if it's able to post its own comments and game the /. moderation system, that's some piece of coding.

Re:kinda scary

[WillDraven]

For an even better example, imagine that somebody makes an app that appears harmless but then at some later date or when remotely activated all the phones it has been installed on begin war dialing 911, clogging up emergency switchboards with calls saying "help, there's chocolate in my peanut butter!!" Something like this would certainly warrant an "oh shit, delete it NOW NOW NOW!!"

Re:kinda scary

[WillDraven]

And of course by war dialing I meant call flooding. Not quite awake yet.

Re:kinda scary

[Anonymous Coward]

Last time I checked Android was true open source as well. You don't have to tolerate any feature or antifeature in the OS. You can still roll your own. Granted this is not something the average person is comfortable doing, but for the slashdot crowd (who is particularly sensitive to these things), they have the technical where-with-all to remove them. I'll take Android any day over a closed system like iOS or Windows Phone/Mobile/whatever.

Re:kinda scary

[WillDraven]

Whether you did or didn't, people sure seem to believe it is true, considering the informative mod. ;-)

Re:kinda scary

[ScrewMaster]

You can still roll your own.

Yes I'm a big fan of Cyanogenmod, myself. Turns the venerable G1 into a useful device.

Re:kinda scary

[macs4all]

I suppose it might be nefarious that they don't even need physical access to your phone to install it. But the install feature probably asks for user confirmation before receiving a "push" install from your carrier, just like my cheap Samsung dumbphone.

Right. Because the DELETE_ASSET API sure asked for confirmation before deleting those apps from potentially MILLIONS of Android phones.

Oh, wait...

Re:kinda scary

[macs4all]

Last time I checked Android was true open source as well. You don't have to tolerate any feature or antifeature in the OS. You can still roll your own. Granted this is not something the average person is comfortable doing, but for the slashdot crowd (who is particularly sensitive to these things), they have the technical where-with-all to remove them. I'll take Android any day over a closed system like iOS or Windows Phone/Mobile/whatever.

Excuse me, but don't all Android phones have some sort of "signing" mechanism for the OS?

So, to actually INSTALL your modified version of the OS, don't you have to break at least the ToS of most cell carriers?

Besides, as you pointed out, it is a vanishingly small subset of the smartphone-buying public (even those who are developers themselves) that would even want to ATTEMPT such a thing as modifying Android, and an even smaller subset of those could actually pull it off successfully.

So, for all practical purposes, Android is every bit as "closed" as iOS.

Besides, if it was practical to install a modified, or even UPDATED version of Android, then why oh why are there multiple comments on slashdot and articles around the intarwebs that insist that isn't the case?

Re:kinda scary

[kbdd]

Blackberry has that capability, which Verizon has used a few times upon my request to reinstall apps following a phone warranty replacement. Of course, there are risks, but Blackberry obviously has controlled those, since the capability has been there since day one and I have never heard of it being exploited.

Re:kinda scary

[rvw]

Something like this would certainly warrant an "oh shit, delete it NOW NOW NOW!!"

Would it? And would it help? This would require the device to check in with google all the time, and that would certainly not be appreciated by the public. I cannot believe that a delete-option will work at any moment, and go unnoticed by the users. So you panic-delete (which it is) will never happen.

Re:kinda scary

[wampus]

Unless you want to count that Bing install that came down the pipe...

Re:kinda scary

[Rich0]

Sounds fine to me. Then there would be no expectation of employees reading email from phones, and those who don't let their employers control their phones are not at a competitive disadvantage to those who do.

In any case, looks like the 2.2 exchange client for android is open source, and I could probably hack out those features in an hour or two if I had to... :)

Re:kinda scary

[nmos]

Is there even a way to turn this feature off? I.e., lets say I buy a handset and I definitely do *not* want Google nuking my apps remotely or adding apps to my phone remotely without my knowledge.

If you're rooted it's pretty easy to remove the market.apk from /system/app . I did this with some of the other default apps that like to start up automatically but I never use.

Re:kinda scary

[DadLeopard]

The only legitimate use I can see for this would be to replace an APP that has been remotely uninstalled as malware with a clean version of the same App! Anything else is, Yeah, Scary to contemplate!

Re:kinda scary

[SETIGuy]

Why would they need to? They could write an app to do it. And then they wouldn't need to hack google.

Re:kinda scary

[SETIGuy]

If you've got the Marketplace app installed (it is by defaults), you're already checking in with google on a regular basis.

Re:kinda scary

[SETIGuy]

You can do those things from settings without being rooted.

Re:kinda scary

[antdude]

Prove it then. :P

Re:kinda scary

[MobileTatsu-NJG]

OKay. Present your butt and watch me not lick it!

Re:kinda scary

[antdude]

Here you go: (_|_)

Re:kinda scary

[MobileTatsu-NJG]

See!

Re:kinda scary

[antdude]

You licked my hairy butt earlier. Ick! :P

Re:kinda scary

[Deefburger]

That is not very far fetched. We've seen stuff "planted" on people as an excuse for arrest before, and in every country, throughout history. I want to be able to turn this "feature" OFF!

Re:kinda scary

[Anonymous Coward]

Nothing Google does is opt in. Even if you don't use any of their services, you are still tracked online, and any email you send to a gmail address is read. They even transcribe voicemails for people using that service, so your calls are listened to without your knowledge.

At least with the government I can't vote them out every few years. A giant corporation is forever.

Good thing that wasn't Apple

[BlueBoxSW.com]

Slashdot headline would have been:

"Evil Apple Hides Secret Rootkit Installer on All iPhones"

Re:Good thing that wasn't Apple

[Mitchell314]

Then it wouldn't have been news. :P

Re:Good thing that wasn't Apple

[chromas]

"Apple Hides Secret Rootkit Installer on iPhone 4"
There, now it's news.

Re:Good thing that wasn't Apple

[Darkness404]

No, no, the real news is "Disable hidden secret Apple rootkit by holding iPhone in left hand!"

Re:Good thing that wasn't Apple

[chromas]

NO DON'T DO THAT!!12three
You know there's digital encryption involved and they're monitoring it. If you purposely cover it then you are violating the DMCA and they'll send teh goverments after you.

Re:Good thing that wasn't Apple

[gyrogeerloose]

Slashdot headline would have been:

"Evil Apple Hides Secret Rootkit Installer on All iPhones"

Any moment now, people will start saying that Google is the New Apple, which is the New Microsoft, which is the New...what? Commodore?

Re:Good thing that wasn't Apple

[ChatHuant]

Any moment now, people will start saying that Google is the New Apple, which is the New Microsoft, which is the New...what? Commodore?

IBM, grasshopper, Microsoft used to be the new IBM. Learn your history!

Re:Good thing that wasn't Apple

[uvajed_ekil]

Slashdot headline would have been: "Evil Apple Hides Secret Rootkit Installer on All iPhones"

Well, that's essentially how we are taking this news, right? Same difference, but Android users don't need the more colorful language to comprehend what's going on. The reporting was spot on, and we get it, without alarmism.

Re:Good thing that wasn't Apple

[TheRaven64]

But what's IBM? The new AT&T?

Re:Good thing that wasn't Apple

[fishexe]

"Apple Hides Secret Rootkit Installer on iPhone 4" There, now it's news.

"Gizmodo Informant Arrested for Exposing Secret Apple Rootkit" will be the news two days later.

Re:Good thing that wasn't Apple

[fishexe]

Any moment now, people will start saying that Google is the New Apple, which is the New Microsoft, which is the New...what? Commodore?

IBM, grasshopper, Microsoft used to be the new IBM. Learn your history!

Microsoft was never the new anything. They basically invented the business model of selling software to hardware vendors, so anyone that replaces them in that capacity is the new Microsoft, but they are the original. This was never IBM's market.

Re:Good thing that wasn't Apple

[BlueBoxSW.com]

But you need alarmist to understand Apple news?

Re:Good thing that wasn't Apple

[SETIGuy]

Doesn't work. Everyone knows Google's motto is "Don't be (openly) evil." Apple's is "Be openly evil." Any rootkit installer on the iPhone 4 would be advertised as an amazing new feature.

Re:Good thing that wasn't Apple

[BlueBoxSW.com]

IBM, aka International Business Machines was named by founder Thomas Watson to one-up the company he previously worked for as a salesperson, National Cash Register, or NCR.

National => International
Cash => Business
Register => Machines

Seriously.

Re:Good thing that wasn't Apple

[mikiN]

Next you're going to tell me that Digital Research's Dr. Gary Kildall and his wife were so brazen to originally name their company Intergalactic Digital Research...

wink, smile, old days...

Re:Good thing that wasn't Apple

[Anonymous Coward]

So what's IBM now?

the...

[prozaker]

Foxdie program continues

Drive-by installing

[kickme_hax0r]

I'm sure someone could create a honeypot wifi network that forces all Android devices that connect to it to install a particular app. Maybe it'll even teach people to stop wardriving.

Re:Drive-by installing

[Darkness404]

Yeah because wardriving is soooo terrible. Look, if you don't want people connecting to your wi-fi network hide the SSD and encrypt it securely. If not, then does it matter too much if you lose a few bytes of data? There are very, very, few people who are going to bother even trying to break an encrypted connection, especially when they can go to a cafe and get free internet pretty much everywhere.

Re:Drive-by installing

[Bozzio]

Look, if you don't want people connecting to your wi-fi network hide the SSD and encrypt it securely

Encrypt it with what, WEP? That would help just as much as not broadcasting your ssid (and, for that matter, as much as MAC filtering). Honestly, these three approaches to "security" won't stop anyone who knows how to book a BackTrack liveCD.

Re:Drive-by installing

[EricJ2190]

You know, we actually have a secure WiFi encryption protocol now. It is called WPA.

Re:Drive-by installing

[Darkness404]

Yeah, and really how many people do you think are going to bother? Lets face it, there are a lot easier targets out there to hack for some script kiddie. For a really, really good black hat cracker they'd need some kind of personal motivation (such as bragging that your network at XXXX address is unhackable) for them to bother.

Lets face it, chances are your neighbors aren't 1337 h@x0rz who are just looking to get into your router and redirect all requests to Goatse, the guy out in his car just wants free wi-fi to check Facebook most probably and the rare hacker is going to pick easier targets.

Unless you personally piss off some black-hat cracker, you live next to one, or you happen to live right next to where Defcon is being held, no one is going to bother to hack your wi-fi because no one cares.

Seriously, if everyone was a 1337 computer knowledgeable cracker, we wouldn't have all these crappy computer "help" and installation centers across the country who charge $30 to pop in a PCI card or $50 to spend 5 minutes clicking "next" buttons.

Re:Drive-by installing

[hedwards]

Depending upon the specifics, it's not that much more secure than WEP was when it was introduced. I think the take home on that is that perhaps involving qualified crypto experts and security experts to design that part of the specification is a good thing. Sure it's never going to be 100% secure, but it's almost laughable how quickly the protection turns out to be easily breached.

Re:Drive-by installing

[Thinboy00]

... or $50 to spend 5 minutes clicking "next" buttons.

That's only $50 dollars an hour, you insensitive clod! Here's the breakdown:
5 minutes of clicking next buttons
55 minutes of WoW (or Minesweeper, Tetris, Facebook, Slashdot, what-have-you).

This so obviously merits $50/hour!

Re:Drive-by installing

[Anonymous Coward]

You're just flat wrong. WPA isn't compromised in any way even remotely as badly as WEP was/is.

WPA:TKIP can, in certain cases with certain AP's allow one to inject packets into the network. Packets won't come back to the attacker.
Perhaps one can use that as a way to leverage some additional resources to attack a network. Certainly, I wouldn't feel good with someone being able to inject packets - but it's not a game-over exploit like WEP was.

WPA-AES: There's simply no known attack against the cypher. You might be able to brute-force the key - but that's an issue of any shared-secret system - it doesn't have anything to do with the crypto in WPA:AES. The solution is to use a large key-space (all ascii characters, not just uppercase alpha's for example.) and long-ish. 10 chars or more. Bonus points for more random and less guessable secrets.

So, IMO, to claim "...it's not that much more secure than WEP was when it was introduced." is really a massive overstatement due to ignorance, at best or just plain falsehoods at worst.

Re:Drive-by installing

[Anonymous Coward]

Sure it's never going to be 100% secure, but it's almost laughable how quickly the protection [of WPA] turns out to be easily breached.

Sounds like you have never done this before!

While WEP is easily cracked, I do it in 2-3 minutes on my 5 year old laptop, WPA is not that insecure.
Cracking WPA requires more work and preparation and is not something you can do while driving around using your laptop.

I myself use WPA2 encryption because it is still good enough. Change the password every now and then and it is "secure"
http://www.aircrack-ng.org/doku.php?id=cracking_wpa

Re:Drive-by installing

[Anonymous Coward]

The thing is... If you're using asymmetric key initiated or based cryptography, you don't need to brute force the keys- so far, it's been a matter of exploits not being known and the relative difficulty of them if they are. And this doesn't get into design flaws within the system. WEP was breakable, not because of the crypto, but because of design flaws that let people exploit the design and get keys. To be sure, WPA and WPA2 are better designs, but it's decidedly difficult to get the design right- and there's typically been design flaws in all of the wireless designs because they're predicated on some semblance of ease of use/ease of deploy- which opens it up to the risks for holes.

WPA isn't as secure as you would imply it is.

More to the point, WPA has been partially compromised in recent times. TKIP is vulnerable to ARP snooping and was the subject of a paper given in 2008 on the subject. As you rightly point out, AES based security in WPA is tougher than TKIP and, for now, is relatively secure. WPA-TKIP is moderately more secure than WEP because it places a difficulty bar for script kiddies to make it not worth the trouble in most circumstances.

At least until someone finds yet another means to attack the system that's better than the last one. All it takes is a bit of good fortune finding a scheme to exploit and you're done. This doesn't mean you shouldn't use WPA, no- but to think it's really all that secure is only slightly better than believing WEP is that.

Re:Drive-by installing

[Svartalf]

Are you kidding?

They'd be keen on getting their hands on the phones- they're making banking apps and the like for them that are less secured in some ways than the web based things because they're thinking the phones are more secure.

They're going to want to PWN those phones for MANY reasons and they'll bother without question- it's just a matter of time.

Call me clueless

[Anonymous Coward]

What was wrong with Linux?

Re:Call me clueless

[Anonymous Coward]

Clueless, happy now?

Re:Call me clueless

[larry bagina]

You're clueless.

Re:Call me clueless

[AHuxley]

Google wanted control so they pushed http://en.wikipedia.org/wiki/Android_(operating_system)
GPLv2 to bait you in, Apache 2.0 to close you down if needed.
You write the 'free' apps, hunt bugs, preach about the 'freedoms', Google tracks, sells ads, data mines, a push and profit with a sting in the tail it seems.

Does this apply to ROMs as well?

[gimmebeer]

Curious as to how this applies to custom ROMs and rooted Android devices. More specifically, since this is a known capability now when will we seem ROMs that specifically disable these features?

Re:Does this apply to ROMs as well?

[uvajed_ekil]

Hmm, I'm sure the indie ROM folks are working on this already. I've so far resisted screwing around with my G1, though I've thought about it. This makes me want to root and go with a non-standard firmware, if it will keep my phone mine.

Re:Does this apply to ROMs as well?

[Svartalf]

If they've got the Market app installed in the firmware, post install, it does.

No

[Mr2001]

I'm sure someone could create a honeypot wifi network that forces all Android devices that connect to it to install a particular app.

Not unless they manage to compromise SSL in order to make the phone think it's talking to Google when it really isn't. If someone manages to do that, we have much bigger things to worry about than a malicious phone app.

Re:No

[fermion]

And yet we see flaws in SSL periodically.

Such flaws are why professional developers do not put in random features that can be exploited. Sure it might be fun toi say that our application has a thousand more features than the competition, but to those that are savvy it is just a thousand more way to be put at risk.

Re:No

[Anonymous Coward]

Actually, this moves android from "my next phone" to a "definite maybe".

I do NOT like back doors. This makes the SSL Cert that would be used to prove one is google a very valuable target indeed. It really makes me wonder if it is a question of "if" or "when". On top of that, why should I trust google with this? If something needs to be installed, on MY PHONE, I want to be, at least, asked.

-Steve

Re:No

[FlyingBishop]

I'm not sure if you're ignorant or just a troll.

In any case, SSL is responsible for securing all updates, OS or app. Break Google's SSL, you've compromised all of the features, and you're not going to bother installing a crippled Android app, because you have root on a full-fledged Linux handheld.

Re:No

[bertoelcon]

-Steve

Woz, doesn't Apple give you Iphones anyway?

Re:No

[bm_luethke]

My suggestion is that you rely on a land line phone then (were I that worried over it I would go with a vintage rotary phone too - no computer to futz with). All cell phones I know of can add or remove features without your permission. Some may choose not to do so, some may regularly do it, but they all do. Even worse an iPhone, Blackberry, or an Android are *not* phones, they are handheld computers that just so happen to have a cellular device attached to them. You LG flip phone that has no apps other than what is on the rom is fairly stable, your smart phone is a computer and has all the issues associated with a general purpose computer along with the access that the carriers have always wanted but could never demand before. Some are claiming an N900 can't have this happen but before I made that statement I would want some independent party to verify, not just the assumption it can't from what I have seen. The competition that the /. crowd is mostly looking at (the iPhone) is just as bad with respect to ability to do things but hasn't decided to do so (yet) - the Blackberrys fall into the same boat.

Pretty much every carrier out there has these abilities, they do so for a number of reasons (few of them are for your benefit though) and that isn't going to change. Indeed, even just the plain cell phone will generally have features they can remotely turn off and on. The iPhone (and IIRC the new 2.2 androids) can be remotely bricked (sold to us a security feature). I have not seen Google do anything that would particularly make them untrustworthy compared to everyone else - indeed I find them better than most (at least they are upfront about the things I do not like instead of lying to me or trying to convince me that raping me is a Good Thing). That is, of course, a kinda loaded statement as I have little trust for any one else - but since I have no choice but to play in that world they are as good as any of the better ones out there. I treat my phone access like any other non-secure communication - I assume anyone and everyone can see it. For secure access I assume most people can see it.

Plus as the GP says - if the SSL cert is broken then the ability to remote install apps on your phone is the least of our worries. Most phones can be bricked remotely not to mention all the secure sites that rely on x.509 certificates.

Re:No

[santiagodraco]

So you don't think Google's professional and you think that the things they do are random? Interesting....

Re:No

[santiagodraco]

Curious.

You do know that phone companies have had this capability for years, right? They can, and do, pretty much anything they want to the remote platforms in the way of remote pushes of new features/capabilities/apps/etc. The extent of which they can do so will of course vary by model and capabilities of the device, but this should not be news to anyone.

Doesn't necessarily make it right, but not surprising in any event.

Re:No

[mysidia]

That's no problem, since bugs are frequently found in SSL implementations.

SSL is a complicated protocol, not a simple one, and it's prone to discovered (and undiscovered) programming errors.

Re:No

[Mr2001]

Actually, this moves android from "my next phone" to a "definite maybe".

I do NOT like back doors.

You always have the option to root your phone and install a third-party build of Android that doesn't have this feature. (Unlike a certain other company, Google doesn't claim that you'd be breaking the law by doing so.)

This makes the SSL Cert that would be used to prove one is google a very valuable target indeed.

As if it isn't already? If you can impersonate Google, you can access everyone's Gmail, AdSense, AdWords, Docs, etc.

Re:No

[dysprosia]

No, you've regularly seen him in line like every other schlub and ex-founder of Apple...

Re:No

[TheRaven64]

He queues just like everyone else, and always offers to pay, but the Apple stores near his house have standing instructions from the other Steve to refuse to take payment from him.

Re:No

[Anonymous Coward]

SSL is the connectivity between the store and the phone.

SSL stands for Secure Sockets Layer. Perhaps you meant the crypto it actually uses as part of it's framework- but it's not the thing that secures the phones itself (and if it does use that, then it's a bad design feature...).

Re:No

[DinDaddy]

Ex-founder?

Re:No

[cool_arrow]

Can you exlplain how installing a 3rd party android build would prevent OTA installs? OTA install capabilities exist at a level lower than the OS. On a GSM handset that would be the SIM. The network operator can install stuff there that you will never see and nobody AFAIK is rooting a SIM. Root the SIM and you root the phone.

Re:No

[Mr2001]

Can you exlplain how installing a 3rd party android build would prevent OTA installs? OTA install capabilities exist at a level lower than the OS.

The OTA install capabilities being discussed in this thread are part of the OS, so you can compile your own copy of Android without them.

Similar capabilities may also exist at a lower level -- I don't know -- but they'd just as likely exist in every other phone, and they're not what TFA is describing anyway.

Really?

[parc]

You mean they can remotely install apps over the air just like every other modern phone on every other carrier I've ever seen?

This is a non-story -- OTA install is pretty much required by every carrier out there so they can force you to upgrade your phone.

Re:Really?

[gimmebeer]

A new OS version or patch, sure. An app, not so much. My Android phones doesn't OTA update without prompting me and me approving it. The meat of the article, in my understanding, is that they have a function that will automagically install or remove an app without user interaction. Is that not correct?

Re:Really?

[Anonymous Coward]

A new OS version or patch, sure. An app, not so much. My Android phones doesn't OTA update without prompting me and me approving it. The meat of the article, in my understanding, is that they have a function that will automagically install or remove an app without user interaction. Is that not correct?

As far as I can tell, Yes. One instance I could see/understand is for this is Google provided programs that are included with the phone (Maps, Gmail, Browser, ext) being forced to a newer version.

Re:Really?

[Darkness404]

Yes but think about it, if there is a terrible vulnerability in the browser, I think I'd like Google to patch it even if it didn't have an entire new kernel and the like.

Chances are your browser is going to be the most targeted part of any OS and it is an app.

Re:Really?

[Anonymous Coward]

OTA updates and installing an APP are in a bit a different category...

Installing a phone OS update (or part of it) compared to installing an app made by (possible) 3rd party, which is not part of the actual phone OS ...

Re:Really?

[Darkness404]

The difference is, an App could very well be a part of the OS (for example the browser) it just isn't part of the Kernel/UI. A critical flaw in the browser certainly warrants a quick update. Plus, OS updates might not always come to phones. With no OS level updates coming to some phones due to manufacture/carrier apathy vulnerabilities need to be fixed somehow, and OTA updates are a good way of doing it for phones who can't support the new technologies with new Android versions.

Re:Really?

[Hizonner]

Actually, according to a talk by Rich Cannings, Google's "Android Security Leader", at Usenix Security '09 in Montreal, Google can choose whether or not to have your phone ask you for permission for an OS upgrade. If they think it's important enough, they reserve the "right", and definitely retain the technical capability, to install an upgrade without asking. The carriers can probably also do OTA upgrades on their own initiative; that part wasn't clear to me.

The whole tone of his talk was scary. There was no sign that he could imagine that somebody might not want to trust Google with total control of their phone, or that such distrust could possibly be legitimate if it did exist. His whole attitude reeked of "we know better than you do", and he seemed to think of the phone's owner more as a security threat than as the person who should be setting security policy. And he didn't even mention the possibility that Google might get compromised.

He also seemed to think of the Android open source project as something to push code to as an afterthought, rather less important than the carriers... whose interests he seemed to think were terribly, terribly important.

It was not reassuring.

And, yes, my understanding matches yours. The article says that they can also install apps, in addition to OTA OS upgrades. In fact, as I read the supporting material, the Market application works by pushing an "INSTALL_ASSET" message to your phone... the same message they'd use to spontaneously install an app. So there's no fixing the problem without either disabling the Market entirely or patching the implementing code.

And of course an OS upgrade could contain code to do anything they want, including enabling them to install apps if they weren't already able to do so.

Re:Really?

[msauve]

Just because the updates which have come out already have asked you to update doesn't mean that is a prerequisite. You are implying ("An app, not so much.") that other phones can't update an app. Not true. "Every other phone" allows carriers to to do over the air updates. If they want to do an app, they can, by pushing a full image which includes that app. That Android is more modular, and allows_just_ an app to be pushed should be considered a benefit, as it allows a less risky way of updating things. Whether Android or not, the carrier has control.

Except, since Android is open, one can expect that "ROM" developers will make available images (at least on phones where privilege escalation has been achieved) which don't allow this, assuming there's demand for it. Try blocking updates on "every other phone."

Re:Really?

[Anonymous Coward]

my old blackberry had a similar feature; which was often exploited by verizon wireless to push icons for new apps and services to my phone without my permission and there was nothing i could do about it...

Re:Really?

[FlyingBishop]

The line between OS version and app is entirely arbitrary, and Google is working to move more of the OS functionality into apps.

From a security standpoint, if Google has access to this, they have access to the OS anyway, installing/removing apps is not a big deal. They already have root on your device (and you don't.)

Re:Really?

[TheEyes]

...he seemed to think of the phone's owner more as a security threat than as the person who should be setting security policy.

To be fair, he does have a point, if in fact that was his view. I mean, how many zombified PCs are out there now, DDoSing servers and spamming the planet, just because their owners can't manage (at a bare minimum) to enable Automatic Updates? Millions? Tens of millions?

I know hating Google is in vogue these days, but let's be honest here: so far, they're no Microsoft. They're not a convicted monopoly; they've gone out of their way to invest real resources in opening their services, actually spending money to make it easier for people to migrate away from Gmail and Google Docs; they sponsor and promote open source; and they compete by constantly making their products better, rather than trying to strong-arm people into buying their junk. So yeah, until they show otherwise, I'm going to be cautiously optimistic and give them the benefit of the doubt.

The question is, is there a way for paranoid individuals to turn this capability off if they want to. Let the Joe Sixpacks of the world live in blissful ignorance, and let Google keep them from bringing the cell networks down with their inability to properly patch and protect their phones; just give me the ability to opt out if I know the risks, and choose to take them.

Re:Really?

[Anonymous Coward]

IIRC OTA updates can be prevented by flashing a new recovery image that replaces the flash_image binary with one that requires the update to be signed with a custom key (like this image does).

I guess the same thing can be done with the marketplace app, but then it loses a lot of its functionality.

And to address something another AC brought up... Google's apps (Maps, Gmail, Browser, ...) are all voluntarily updated, automatically, by adding a new notification status entry. Ditto for all other (non-Google) apps. IIRC it even prompts when running the market app.

Re:Really?

[rudy_wayne]

Yes but think about it, if there is a terrible vulnerability in the browser, I think I'd like Google to patch it

I would prefer that Google didn't put a browser on my phone that contains a "terrible vulnerability".

Re:Really?

[Darkness404]

Right, because we all know that there are perfectly secure computers. Perfectly secure software. Silly Google for not adding in Perfectly Secure Browser V 1.0

Lets face it, the only secure computer is one in a perfectly secure vault, powered off and has the only person know where the vault is killed.

Re:Really?

[Darkness404]

My guess is though, Google isn't going to do that. Carriers are their number one hindrance to innovation.

Re:Really?

[Anonymous Coward]

For image updates, they have blocked them. For app updates/[un]installs, they can't... the market app is closed-source. I think there was a reverse-engineered OSS replacement, but that's all I know.

Re:Really?

[Americano]

If it's google software, it's "Perfectly Secure Browser (Beta!)" and will remain so for a good couple years before it reaches v 1.0.

Re:Really?

[Dhalka226]

The question is, is there a way for paranoid individuals to turn this capability off if they want to.

There shouldn't be, for all the reasons you gave in support of why users really ARE a security threat rather than the ones who should be setting security policy for their phones. If the question is "does Google or the owner know better whether or not something should be installed?" the answer can't be "Google, but they should make a checkbox that says 'lulz just kidding, I'm smarter, turn it off.'" It's not logically consistent. Whether "Google" was the right answer or even if that was the right question is, of course, a different matter.

Re:Really?

[Anonymous Coward]

The whole tone of his talk was scary. There was no sign that he could imagine that somebody might not want to trust Google with total control of their phone, or that such distrust could possibly be legitimate if it did exist.

Yeah, if I don't want to trust a company to have control over the device that I hold in my hand. I definitely must to get the device from the said company that publicly acknowledge that they have control over the device.

Re:Really?

[sumdumass]

Don't you think that Google should have some user interaction with the update so when the terribly vulnerable security fix version breaks my crappy app for work, I know I need to yell at the developers to fix it and point them in the right direction?

I mean that's a big problem with windows automatic updates. Well, not so much any more, but it used to be that someone would update the OS, then some app or piece of hardware would break, and then you spend 10 hours attempting to figure out why it worked the night before but not today- not knowing that they just updated their OS because Microsoft wouldn't ever be the cause of something like that. The worst part is that it only broke on one out of 20 computers.

I'm glad windows now has the ability to lock users out of the updates until it can be approved before installing.

Re:Really?

[drinkypoo]

There was no sign that he could imagine that somebody might not want to trust Google with total control of their phone,

There's no such thing as trusting them with partial control of your phone because if they can push anything to your phone they can probably root it. So either install your own distribution of Android (perhaps CM) and disable this functionality or accept that others will be helping you manage your phone.

Re:Really?

[whatajoke]

Nokia phones do not have this "american feature".
And I am happy with that.

Re:Really?

[TheRaven64]

I'm guessing that you're in the US, in that case. My carrier can push updates to the SIM card (which they provided), but they don't even get told what kind of phone I'm using and there is no feature for them to push updates to it. Even SIM updates require me to permit them, although if I don't then (theoretically, at least), my phone could lose the ability to connect to the network.

Re:Really?

[fishexe]

The question is, is there a way for paranoid individuals to turn this capability off if they want to.

There shouldn't be, for all the reasons you gave in support of why users really ARE a security threat rather than the ones who should be setting security policy for their phones.

There should be, for the reason that only some users are a security threat (as described in GP, the ones whose PCs are DDOS-bots and such) while others are not (those of us who update regularly and don't run untrusted executable downloads or other shifty things).

If the question is "does Google or the owner know better whether or not something should be installed?" the answer can't be "Google, but they should make a checkbox that says 'lulz just kidding, I'm smarter, turn it off.'" It's not logically consistent.

It's not logically consistent only if you assume all users are identical. isn't it more reasonable to say that Google is better at deciding than those users who never figure out where the check box is or never care enough to check it, and Google is worse at deciding than the people who both know enough and care about security enough to go looking for the opt-out?

Re:Really?

[TheEyes]

How is that not consistent? For the vast majority of users, a phone is an appliance, just like a PC is an appliance, or a refrigerator, or a car. They don't know what is involved in maintaining that phone, or the security risks associated with using the phone, nor are they particularly inclined to care; they have more important things to do with their lives, like hold down a job, take care of kids, keep up with politics to be a better informed voter, etc. For these sorts of people, whom I suspect makes up at least 90% of the population (maybe more), it makes perfect sense to have a (for now) trusted source seamlessly take care of the security of the phone transparently, without them having to do a thing.

Note that this is exactly why Vista's UAC is the exact wrong way to handle security for the "normal" user: they don't know what's in their best interest, nor do they have the time and/or inclination to find out. Now, obviously they should take the time, but, seeing as they are already choosing not to, the only viable solution is to do it for them. It's the same reason programmers are told never to roll their own cryptography solution: for most of the population it's hard for them to get it right, and instead should rely on established solutions.

On the other hand, there is that other ten percent who does care and has time to learn the issues involved in privacy protection and information security. For these people, it makes perfect sense to allow them the option to "go it alone," to reject the one size fits all security that a default install would imply, and perform their updates manually.

Re:Really?

[mordejai]

I'd like to see them try to update my Nokia 1100... No, really. I'd like that.

Re:Really?

[hitmark]

thats been the attitude in the telco related field since its establishment.

Re:Really?

[Anonymous Coward]

You mean they can remotely install apps over the air just like every other modern phone on every other carrier I've ever seen?

This is a non-story -- OTA install is pretty much required by every carrier out there so they can force you to upgrade your phone.

Not with blackberry. With blackberry, the owner of the phone (you or your company) decides what software goes on it.

Re:Really?

[Anonymous Coward]

my old blackberry had a similar feature; which was often exploited by verizon wireless to push icons for new apps and services to my phone without my permission and there was nothing i could do about it...

Actually, Verizon CAN'T push out applications to your blackberry. No carrier can.

You might recall when Etisalat [engadget.com] (a carrier in the United Arab Emirates) wanted to install spyware on all blackberries in the country.

They had to trick users to install the software manually, because the carrier couldn't do it themselves.

What Verizon is doing is pushing out an icon, and then you can click on the icon to download & install the application. The icon isn't the application itself.

You can block these icons from your blackberry enterprise server, it's under "browser" and "allow application download services". Set this to false, and then the icons disappear.

Re:Really?

[Anonymous Coward]

If you put your balls in their hand don't be surprised when they squeeze. This goes for Apple and Google alike.

Re:Really?

[Anonymous Coward]

His whole attitude reeked of "we know better than you do"

No shit, they made the android OS. They DO know better then you.

Re:Really?

[rentmej]

With version 2.2 of Android and a Google Chrome extension ChromeToPhone YOU can do an OTA install of an app on YOUR phone.

Re:Really?

[Svartalf]

I don't want them updating my stuff surreptitiously- I want to get it as a regular update notice. I also don't want them yanking just any old thing off my phone without my permission. If they have the ability, it should be like an update notice and ask me if I want them pulling it off my phone.

Re:Really?

[Svartalf]

Excuse me...

THEY DON'T HAVE THE RIGHT TO UPDATE MY DAMN PHONE WHENEVER THEY WANT TO.

It's not a services offering by Google.
It wasn't disclosed as such at the time of purchase.
It uses a services offering by Verizon, but that's distinct from the phone.

It's MY device and I paid for it without any statements of Google owning that phone, or the Android system being a services offering.

To do what they're claiming will open them up to a lawsuit as it's illegal for them to do so, regardless of the technical capabilities. If you thought Amazon caught hell over what they did (and the Kindle IS part of a services offering...)- just wait and see what's going to come of this stunt they've pulled and if they try to pull it again.

Re:Really?

[Svartalf]

This has little to do with hating Google.

They've done something that other software companies have been drug into court over and lost hard on. It's not legal for them to DO this in the first place.

Re:Really?

[Svartalf]

UAC might be the wrong way. What you propose is even worse, in truth.

You're advocating them owning your machines- even the appliances. Do you think it appropriate that Maytag or Whirlpool owning your clothes washer and dryer? If so, I've got a bunch of things to "sell" you that I want to retain control over and be able to change up or repossess at any time.

If you don't, WHY do you think it appropriate for Google and others to have this same sort of situation?

Re:Really?

[kbdd]

I can see a lot of people come to this from a desktop perspective, the perspective that says "I own my computer, keeps your hands off of it." A couple of issues that make phones different from computers is that most phone users do not really "own" they phones during the initial 2 years contract, and the fact that the phones have really limited usefulness without the phone network, so it gives the phone company more moral authority (leaving the legal aspect aside, IANAL) to do what they feel they need to do to protect their property/assets (phone and network). I can see the phone company's point of view, and as far as I am concerned, having used Blackberries for about 5 years (AT&T first, then Verizon), I can see the value of it, even as a user. In the few cases where I had to call the phone company because an app would not install, they were able to quickly and painlessly resolve the problem OTA without having to visit a store or disable the phone for any length of time. Based on my experience, if done right, it is a non problem.

Re:Really?

[Anonymous Coward]

And that's standard stuff on most modern phones. Check the Open Mobile Alliance Device Management specs (OMA-DM), specifically the FUMO (Firmware Update Management Object). Yes, it is intended for upgrading the firmware over the air, but the fact is that you can push whatever you want. And the push can ask the user confirmation, for non critical updates, or force the update for critical updates. Up to the operator. This said, I'm not sure it's used very often...

Re:Really?

[Shazback]

How does that advocate Google owning your telephone if the default setting is for them to force certain installs/uninstalls, but that setting can be opted-out?

Wouldn't a better representation be that they are offering a service to the end user as part of the contract by which the end user, the handset manufacturer, the carrier, the developers of apps on the marketplace and themselves?

I'm uneasy with the concept of "forced install/uninstall without notification". However, I can see what TheEyes is trying to say. People like my mother would see the message, not understand it (even if it just said "For security reasons, Android recommends uninstalling the following application <Application name>. UNINSTALL/DO NOT UNINSTALL"; ibid for the install process), and would therefore be liable to make the choice that puts their data at risk.

If there is a choice in a "deeper" Settings menu to permanently disable these remote install/uninstall features, but this reduces the liability of the other parties in the case of privacy problems, I can't see what the problem is. Most people won't look for it or disable it if they find it, and the people who are concerned about this feature can delete it. By combining the "no remote update/install from Google" setting, the notifications on all but the most extreme security risks, and the notification-less install/uninstall for the few critical errors, Android OS would provide both the features that normal users want ("It just works") and those that power users and security freaks want.

Re:Really?

[Anonymous Coward]

How can one justify this behavior for Google, and not Apple?

Apple’s walled garden achieves exactly the same goal.

Re:Really?

[qubezz]

most phone users do not really "own" they phones during the initial 2 years

You do own the phone (physically), but in consideration for the discount you got on it, the phone company pwns joo for a $350 early termination fee if you stop sending them their monthly ransom on the service contract. The phone is still yours to do with as you please.

Mobile phone carriers have just tried to give you the impression that you don't own the phone, by making the phone you own useless for doing anything other than connecting to their network and buying ringtones on their web portal that cost more than the full song download.

They do this through technical hindrance such as unique protocols (cdma vs GSM), unique frequencies (3G on 1900MHz vs 2100MHz), carrier SIM lock (or no sim at all), or vendor-specific firmware (see CDMA phones), auto-jamming your phone with their service books and restriction software (i.e. put the carrier's SIM card into the unlocked Blackberry you bought outright [don't even need to connect to their network] and your phone's wi-fi & GPS mapping software is disabled so they can sell it back to you for $10-$30/mo), and by black-listing the device's IMEI if they didn't like how you left their service.

Re:Really?

[nmos]

The whole big picture idea of Android phones is that it is "Integrated" with the cloud. Gmail, Maps, Docs, Calendar, Market...... Even a lot of third party apps rely on google services to do their thing. All of that integration enables a lot of flexibility , the ability to switch phones/devices without having to migrate your data, ability to push cpu/storage intensive apps like translation off to Google's servers but the trade off is that your phone is very reliant on the network and especially Google. Now I can see why someone wouldn't be comfortable with that arrangement, heck I'm not sure I'm comfortable with it and that's part of why rooted my Droid right away but if you've bought into the whole concept of your phone just being a "dumb terminal to the cloud" then it seems silly to complain that they can install/remove apps.

Re:Really?

[ADRA]

"The article says that they can also install apps, in addition to OTA OS upgrades"

This was demonstrated by Google to the world at a Google I/O keynote. Go watch it now. The feature is that from a web page, you can click on an app and say 'install now' or whatever and the app installation gets pushed to the phone just as if you hit the 'install' button through the app store. This is not smoke and mirrors behind the scenes. Its an advertised feature.

http://www.youtube.com/watch?v=IY3U2GXhz44&feature=channel
View from minutes: 31:00 onward

Re:Really?

[nmos]

How could you possibly be posting on /. and not have understood how this thing works? Also this functionality is part of the Market app and it DOES disclose what it can do the first time you run it at which point you can choose not agree. Android works just fine without the Market app so I don't see the problem.

Re:Really?

[RobertM1968]

A new OS version or patch, sure. An app, not so much. My Android phones doesn't OTA update without prompting me and me approving it. The meat of the article, in my understanding, is that they have a function that will automagically install or remove an app without user interaction. Is that not correct?

I would bet good money that the capability to bypass the prompts/user interaction has always worked on this and other platforms. Heck, it's no difference than the forced updates on Windows and other PC operating systems. These phones are, after all, computers as well... with operating systems running on them, cell hardware and cell programs handling calls...

Why do you expect the Android Operating System to be any different? And unlike Windows or MacOSX (where it's very difficult to near impossible to make your own custom version), one can install a custom ROM from someplace else - or even build their own if they are that paranoid.

Re:Really?

[RobertM1968]

The question is, is there a way for paranoid individuals to turn this capability off if they want to.

There shouldn't be, for all the reasons you gave in support of why users really ARE a security threat rather than the ones who should be setting security policy for their phones.

There should be, for the reason that only some users are a security threat (as described in GP, the ones whose PCs are DDOS-bots and such) while others are not (those of us who update regularly and don't run untrusted executable downloads or other shifty things).

Only SOME users? Please define "some" when discussing the Windows world. The Downadup worm infected over 1.1 MILLION Windows PCs in a DAY. As for the Storm botnet crap, Microsoft claimed that 10% of the machines they scanned were infected. That too is not a trivial number or "some" as you define it. Conflicker infected over SEVEN MILLION machines (that we know of). Kaspersky indicates that they remove malware at the rates of MILLIONS a month - and that's just them and their software. That doesnt cover AVG, McAfee, Symantec, Microsoft, or the plethora of other anti-malware vendors/solutions out there - and doesnt even begin to touch on the users who have no protection.

So, again, I suspect that your definition of "some" may be incorrect.

With the growing and currently pretty large number of Android phones (or iPhones), I doubt that "some" is an applicable term either. What makes it worse is that most people never consider that their smart phone (ie: COMPUTER with phone functionality) can be infected... so unlike in the Windows world, where most people are aware their PCs can be infected and take actions to remove unwanted stuff (malware), there is virtually no such effort (or knowledge about such things) in the smartphone world.

Re:Really?

[fishexe]

The question is, is there a way for paranoid individuals to turn this capability off if they want to.

There shouldn't be, for all the reasons you gave in support of why users really ARE a security threat rather than the ones who should be setting security policy for their phones.

There should be, for the reason that only some users are a security threat (as described in GP, the ones whose PCs are DDOS-bots and such) while others are not (those of us who update regularly and don't run untrusted executable downloads or other shifty things).

Only SOME users? Please define "some" when discussing the Windows world.

I don't have a precise definition, and I don't need one. An undetermined portion of users that is less than the whole. My point still stands just fine.

The Downadup worm infected over 1.1 MILLION Windows PCs in a DAY. As for the Storm botnet crap, Microsoft claimed that 10% of the machines they scanned were infected. That too is not a trivial number or "some" as you define it. Conflicker infected over SEVEN MILLION machines (that we know of).

You realize you're talking about an installed user-base of hundreds of millions, right? So yes, seven million is "some". 1.1 million in a day is "some". 40 or 50 million is "some". I don't care to debate whether the users who are security threats are a majority or a minority, because frankly I don't care. All I'm saying is, no matter how small the group of non-security-threat users is, it contains very nearly 100% of people who both want to and can figure out how to disable unauthorized remote updates, and therefore an opt-out is not a security threat, nor a contradiction. Throwing big numbers and capitalized words at me isn't going to change that.

Re:Really?

[kbdd]

I do not disagree with you, but in the end, many users feel more like they are leasing the phone, except that after two years (at the most), they ditch it to get a new one instead of returning it.

I am with Verizon, and I am lucky that I got there through Alltel, as they grandfathered my old Alltel contract, the same contract with Verizon would cost me substantially more, and I would not be with them if I had to pay what they are asking from new customers.

However, I enjoy having access to Blackberry maps and GPS without the fee, and I also use the Skype applet extensively for cheap international calls and access to other Skype clients at no cost.

Overall, while I would benefit from a lower cost data plan with limited capacity (I typically use less than 200MB/month, even though I recently started using Pandora, so that may change...), I am satisfied with the service and my Blackberry phone, even more so considering that in a year and a half with them, I have not had a dropped call, while in the 3-4 years with AT&T before that (business phone, now canceled), I had dropped calls routinely, and calls that went nowhere (dial->disconnect) about half the time I called. No way I will go back to AT&T

Re:Really?

[RobertM1968]

It's your use of the word, implying that since it is some (as in unspecified amount), that it isnt an issue. My point on the other hand was that your premise, and thus the implied mean you selected for "some" is invalid. Which it still is. As an example, while 10% (as cited in my earlier post) qualifies as "some" it is a tremendous security risk for "others" who comprise the 80-80% of users who do not know how to properly secure their device (whether PC or smartphone).

Inotherwords, you can keep trying to downplay the importance of this by using the word "some" but it does not change the facts...

Re:Really?

[fishexe]

?????????
What exactly do you think my premise was? I didn't imply that "some" meant "it's not an issue". I implied that "some" meant that a one-size-fits-all approach was not necessarily appropriate or logical. I'm not sure where you learned reading comprehension, but yours is clearly substandard. I suggest you take some remedial English to rectify this issue before you resume posting in forums where your nonsense can endanger others' sanity.

Re:Really?

[ceoyoyo]

B-b-but Google was supposed to be different!

Re:Really?

[Svartalf]

Considering that the statement they make only really applies to the stuff acquired via the service, and that they can yank anything they want and INSTALL anything they want with this application that is a problem.

It's a bit bigger of an issue than what you make it out to be- partly because it's difficult to get things in on the app without another 3rd party market, and partly because it's capable going WELL beyond the statement they made to you when you started it up- and if you've never opened the market app, they shouldn't be able to DO what they're able to do because you've not agreed to it; but they CAN.

In the end, it's more along the story of what I'm painting than of the one you're painting. But then, this IS /., now isn't it? Why am I surprised that you missed something important there just to lecture me about missing things? Oh, snap, I'm not.

Re:Really?

[RobertM1968]

?????????

What exactly do you think my premise was? I didn't imply that "some" meant "it's not an issue". I implied that "some" meant that a one-size-fits-all approach was not necessarily appropriate or logical. I'm not sure where you learned reading comprehension, but yours is clearly substandard. I suggest you take some remedial English to rectify this issue before you resume posting in forums where your nonsense can endanger others' sanity.

No, you forgot that, with all the people who think this is an issue (even though it already exists in virtually every smartphone) that the 90% who do not know how to support their machine should be able to disable the feature - which very very many will - even though it will be to the harm of the rest of the user base, available bandwidth, data plan pricing (as the infected phones eat so much bandwidth that more carriers consider doing away with flat rate plans - as some already are), and so on.

As an example, though I keep my machines very secure, I have, during certain bot exploits out there, watched my bandwidth take a hit because of all the unprotected machines out there that were infected and had my IP block in their attack range.

Re:Really?

[fishexe]

Once again, if 90% don't know how to do anything intelligent with their machine, by all means leave it in for that 90%. I'm just saying give an opt-out switch for the remaining 10%. This has nothing to do with whether your bandwidth is taking a hit from botnets. We all know botnets exist and that they wreak havoc on the internet. You seem to be arguing an issue that wasn't even part of the discussion.

Re:Really?

[RobertM1968]

Once again, if 90% don't know how to do anything intelligent with their machine, by all means leave it in for that 90%. I'm just saying give an opt-out switch for the remaining 10%. This has nothing to do with whether your bandwidth is taking a hit from botnets. We all know botnets exist and that they wreak havoc on the internet. You seem to be arguing an issue that wasn't even part of the discussion.

Ummm... how do Google and others enable the opt-out for the 10% while disabling it for the 90%? Without purchasers taking smartphone/computer literacy tests before purchase, I dont think Google or Microsoft or any other smartphone or computer OS developer will know how to differentiate between the 90% and the 10%, leaving an all or nothing approach the only feasible one.

Re:Really?

[fishexe]

I told you the answer to this waaaaaaay back at the beginning of this thread. The 10% will be the ones who both care enough to look for a disable switch, and are smart enough to find it. The 90% will either not care that someone can install things remotely, or not figure out how to disable said feature. Rather than dispute this reasoning, you just yelled at me that I didn't know how big the 90% is.

Intelligentia

[Anonymous Coward]

I think the name is what's most interesting -- INSTALL_ASSET - that has a distinctly govt feel to it. Gotta wonder.

Android Dev Blog

[Anonymous Coward]

Android developers blog ( http://android-developers.blogspot.com/2010/06/exercising-our-remote-application.html ) only says that they have removal power. But if INSTALL_ASSET is true - it might have something to do with the "Go to a website and send a link to your Android device to open it directly on the Device's browser or Maps App as the case may be" feature that they announced at Google IO(I forgot if / what they called it something). So you send may be a intent to install a new App that you saw on some website and it would install it automatically. This *could* be made to work securely - i.e. requiring your Google Account authentication to be able to send install intents. But if there is a bug somewhere - it could have dire consequences.

Not so terrible

[Darkness404]

Really, this makes a bit more sense than having 234234234324234 OS updates every year. The majority of updates can be done by removing/updating apps, not to mention security patches. Really, some phones already have the latest Android they will ever get, barring rooting. But people will keep using that phone for 4+ years, that is a long time to have a security flaw out there that could steal information. Since the browser is going to be the main attack vector which is an app, it makes sense.

While this could be used to push more carrier crapware, I think updates and upgrades of installed apps are more likely to work for more phones and easier for the average user to use.

In all honesty, would you rather be using an outdated version of a browser with security flaws because your phone doesn't support Android 2.75 Double Chocolate Chunk Cookie or just have your browser update to a more secure version OTA?

Re:Not so terrible

[Anonymous Coward]

But you are assuming that you installed the app in a 1st place...

What I'm gathering here is that they could install a brand new app for you ... how do you feel about that?

Re:Not so terrible

[Darkness404]

Ok, so Google can install new apps to give new features? Not really sure what I should be worried about... Yes I know they -could- install in new applications which are completely evil provided by Sprint/T-Mobile/Verizon/AT&T but I'm not sure if Google would end up doing that because carriers really hold back Android more than anything else.

There is competition now in the phone market, Google doesn't want to screw up anything because I could go to iOS, BlackBerry OS, WinMobile, Symbian, or heck, I could just root my phone and remove the crap.

Google attracts the people who don't want to play games and jump through hoops like you have to with Windows Mobile or the iPhone. Google knows this and wouldn't want to kill their main vocal market.

Re:Not so terrible

[gandhi_2]

As the android user base gets more mainstream, the "vocal" nerds will be drowned out by people who just want cute shit.

This crowd will accept what-ever crapware the carriers want them to have, they always have....and Google won't find it so hard to just give in.

Inevitably, the OTA install function will be abused.

Re:Not so terrible

[Darkness404]

But Google won't see a point in installing crapware OTA. Google has no "YOU MUST DO THINGS OUR WAY" like Apple does, Google also is blocked from really innovating because of the carriers, I have little doubt in my mind that if Google didn't think that carriers would make a huge deal about it, Android would have tethering from the beginning and a lot of other features.

If worse comes to worse I have little doubt in my mind that Google will keep top-tier phones free from crap similar to the Nexus One and the G1 Dev Phone.

Re:Not so terrible

[Americano]

Yep, because google's not an advertising company, and would never want to, say, install an app that brings you the "great new feature" of automatically pinging their servers with a GPS coordinate and downloading location-relevant ads right to your phone!

Point is - you aren't offered a choice. Point is - you aren't being asked, "is it okay if we do this?" I don't care what the feature is, I'd take severe issue with someone deciding, "here you need this." And let's be honest - updates aren't always flawless... if Google bricks my phone accidentally, will I be able to recover any important data I might have had on there?

Re:Not so terrible

[PitaBred]

If you aren't making backups, your data is more vulnerable to a toilet than it is to Google. Google's ads are GPS-sensitive... if you decide to give the browser access to your location information. It's actually pretty well done, and hey, it's open-source. If you don't like it, compile a copy yourself without that stuff. Or get someone else to... there are lots of android hackers out there.

Re:Not so terrible

[AHuxley]

like Apple does ? Apple is clear about its installer and updates.
Google has just been noted for its push and pull reach. Something that the open source community seems to view as very DRM, Apple, Sony, MS like.
Apple, Sony, MS may talk about open code and have set views on it, but Google actively uses it for the total OS look and feel.
Thats why this is so interesting. Messing with a users phone in both directions, install and removal is something new.
Google seems to be doing fine in innovating too with legal ideas of world wide 'mistakes', remote software and ads.

Re:Not so terrible

[mysidia]

, the "vocal" nerds will be drowned out by people who just want cute shit.

" The user's going to pick dancing pigs over security every time." --Bruce Schneier

Re:Not so terrible

[Anonymous Coward]

if Google bricks my phone accidentally, will I be able to recover any important data I might have had on there?

That's your mistake right there.

Re:Not so terrible

[fishexe]

... if you decide to give the browser access to your location information. It's actually pretty well done, and hey, it's open-source. If you don't like it, compile a copy yourself without that stuff...

Which will work great...UNTIL they remotely force your phone to download an identical version with all the stuff you took out back in, without your knowledge or consent, like this "feature" allows them to do at will. Isn't that the point of this whole discussion?

Re:Not so terrible

[Jesus_666]

Ok, so Google can install new apps to give new features?

Of course they can also install new versions of apps to remove features. Let's say the mobile provider who sold you your phone decides to make something a premium feature. They can just push an appropriate update via Google and suddenly one of your apps has some restriction built in and a link to their homepage that explains how you can get the functionality back for just ten Dollars a month.

And no, Google wouldn't take a stand for the user. They would take a stand for the company that makes them all the licensing money and can switch to another mobile OS for future devices if they don't like Google's service.

Re:Not so terrible

[wampus]

Don't worry, Google has a backup of all your important data.

Re:Not so terrible

[Anonymous Coward]

I totally agree, but I'd like to add : Since you are not even asked, how can you make a backup of possible important data on your phone before the update ?

Re:Not so terrible

[PitaBred]

...if you remove the remote force install function, how exactly will they accomplish that?

Re:Not so terrible

[fishexe]

...if you remove the remote force install function, how exactly will they accomplish that?

You presumably can't. You just said the browser was open source and you could compile your own. You said nothing about the rest of the OS.

Re:Not so terrible

[PitaBred]

Oh, so you're just stupid. Android is built on Linux. Pretty much all of it is open source:

http://source.android.com/

Re:Not so terrible

[fishexe]

Oh, so you're just stupid.

Yep. That must be it. Not knowing everything you know makes a person stupid. Especially in a thread where others are discussing Android being dual-licensed so that parts of it can remain closed. Everyone must either know 100% of the details of that, or be a complete and total idiot.

Re:Not so terrible

[PitaBred]

If you don't know anything, why do you keep having opinions about it?

Re:Not so terrible

[fishexe]

Probably for the same reason you don't know the difference between not knowing everything and not knowing anything.

It's to reinstall malware that they removed...

[John Hasler]

...when Slashdot raises a stink about them removing it.

"Oops. Sorry. Here's your keylogger back."

Wow.

[tpstigers]

Calling it INSTALL_ASSET makes it seem so real.

Re:Wow.

[Anonymous Coward]

I saw a function called "cut" and another one called "paste" on my Android. Imagine if Goolge started using those features at random? And you stupid idiots are always knocking my iPhone because it didn't have those functions.

We saw this at Google IO 2010

[JustinRLynn]

Does anyone remember the android demo at Google IO where they showed the remote install feature from the android market on a desktop browser in froyo? Seriously, just because there is remote install functionality in the OS doesn't mean that it's there for malicious or secret use -- it's most likely part of a user facing feature.

Re:We saw this at Google IO 2010

[BikeHelmet]

Someone already commented that the Market app likely pushes such commands to your phone.

If true, then I have to ask - do you get any confirmation popups after clicking the install button? (I don't have an Android phone or device, so I wouldn't know)

Re:We saw this at Google IO 2010

[HiThere]

What it means is that it there for use. Good or bad don't enter into it, it's a capability.

Once you realize that the capability is there, you can make an informed decision. (Personally, I've decided that I'm not buying an Android either. I've already made this decision about many other platforms, but I had been thinking about getting an android.)

It's coming up to time to decide on a new phone. It looks like I'll be going with the cheapest one again rather than buying a fancy one. But there are still a couple of contenders that I haven't ruled out.

Re:We saw this at Google IO 2010

[Anonymous Coward]

If the app has any special permissions associated with it, like SMS message access, contact list access, SD card read/write,etc then there is. You get an interstitial screen that shouts all its access privileges at you in red letters, and it requires you to scroll down and hit okay. If the app doesn't use any special permissions, then it'll skip that and go straight to downloading it.

You cannot download an app from the market without seeing what data it has access to, which is why that article from the other day was such total fearmongering. Shocking, this contact manager app I'm downloading can access my contact information!

Re:We saw this at Google IO 2010

[uvajed_ekil]

Seriously, just because there is remote install functionality in the OS doesn't mean that it's there for malicious or secret use -- it's most likely part of a user facing feature.

For the most part, I trust Google, T-Mobile, and even Microsoft. I don't question their intentions, or their desire to keep us and the networks as secure as is reasonably possible. But sometimes things go awry, and capabilities for remotely forced installs could of course theoretically be co-opted by someone with more malicious intentions. That's the bit about all this that scares me.

Re:We saw this at Google IO 2010

[Anonymous Coward]

For the most part, I trust Google, T-Mobile, and even Microsoft.

You trust Microsoft? Wow. =P

Re:They also removed the restraining bold from C3P

[drcosquared]

It was Luke who removed the restraining bolt from R2D2.

Really Really Really? No.

[Kludge]

My "most modern phone", the N900, is not bound to any carrier, and I am quite certain that my carrier does not have the ability or a clue how to install anything on it. I'm root. Not them.

Apple and Android folks: Enjoy being someone else's bitch.

Was this post obnoxious? Yes, in a very nerdy way.

Re:Really Really Really? No.

[Vegeta99]

I mean, be obnoxious all, I was too when I had a WinMo phone - I could replace my radio with a random noise generator if I pleased!

But, I just upgraded to iOS 4 on my iPhone 3G, and the second the phone booted, it was jailbroken (thanks, Sn0wbreeze!), and about 5 minutes later, I had the mysterious "Apple Kill Switch" turned off.

My phone runs whatever code I want it to, and yes, the process was just as easy as rooting your Android phone.

(Plus, my car adapter is definitely better than yours :P)

Re:Really Really Really? No.

[Anonymous Coward]

App installs don't require root privileges. That would be an inherently stupid design.

I assume there is some level of permission on the Android that lets a service/app modify the APK sources. I would assume this is what Google's Apps Installer is already assigned.

Re:Really Really Really? No.

[EricX2]

Does it work with Verizon? What about Sprint? You must live in a modern country where the choice of GSM carries isn't limited to horrible (AT&T) or horrible (T-Mobile). The other providers are slightly more horrible due to them using proprietary phones. I'll take being raped by AT&T with my unlocked phone over being raped by Verizon with my Verizon phone.

Re:Really Really Really? No.

[SpazmodeusG]

Well the process would be just as hard on Android but he isn't running Android.
His phone has an officially supported root mode. The root mode isn't killed by updates. It doesn't stop the updates from working. Nor does it prevent you using any applications you could use before like the app store. It doesn't void your warranty. It doesn't require a re-flash.

So no, the process of getting root for you wasn't as easy for you as it was for the GP.

Re:Really Really Really? No.

[Anonymous Coward]

Connectivity:
GSM+GPRS+EDGE+UMTS+3G+WCDMA+HSPA at 850/900/1700/1800/1900/2100

So yes it supports all of those networks

Re:Really Really Really? No.

[uvajed_ekil]

Dang it, I'm much happier with T-Mobile (except for the lack of 3G at home) than I ever was with AT&T, but now I really want an N900 (even more than I did yesterday). I've also been considering switching to Credo Mobile, since the liberal-progressive/ethical niche they've been claiming suits my own beliefs. Just not sure about using a smaller company, even though they apparently use Sprint's network, or shelling out a bunch for a new phone when I'm mostly happy with mine. Too much information! Go back!!!!

Re:Really Really Really? No.

[cbhacking]

Seriously, this is a worthwhile point. Maemo (OS on the N900) *IS* Linux, not a fancy face on top of it that takes away your control. The default user is not root, but you can become root. The package manager software is setuid root, but you can fix that if you want to make it impossible to install apps without entering a password.

Re:Really Really Really? No.

[richie2000]

Which is just about the same as Android, then. Google releases the Android source so you could patch the install mechanism if you wanted to. I'm root on my Nexus 1 - that is basically just a command away.

The thing is, just because I am root and has access to the source code doesn't mean there aren't backdoors that hasn't been detected yet. I don't see how Maemo is different in that regard. Or say, Ubuntu. There COULD be a hidden backdoor somewhere, cleverly obfuscated for when Mark Shuttleworth wants to take over the world and reveal himself as an alien (his trip into space was him being homesick). I'm not saying there is, I'm saying there could be, and you being root can not realistically prevent that scenario.

Sometimes, you just have to go with a best effort, say "fuck this" and actually trust someone.

Re:Really Really Really? No.

[Urkki]

Dang it, I'm much happier with T-Mobile (except for the lack of 3G at home) than I ever was with AT&T, but now I really want an N900 (even more than I did yesterday). I've also been considering switching to Credo Mobile, since the liberal-progressive/ethical niche they've been claiming suits my own beliefs. Just not sure about using a smaller company, even though they apparently use Sprint's network, or shelling out a bunch for a new phone when I'm mostly happy with mine. Too much information! Go back!!!!

Well, look at your financial situation. Then look at the price of switch involved, including the worst-case scenario of you having to switch back for whatever reason. Then look at how strongly you feel about the involved issues. That should easily tell you if you want to pay the price or not.

Re:Really Really Really? No.

[markdavis]

>Which is just about the same as Android, then. Google releases the Android source
>so you could patch the install mechanism if you wanted to.

No, it is not the same at all. In Palm WebOS Linux and in Maemo Linux, you don't have to "hack" the device to gain root like you do with Android. If you want to be root, you can do so, without ANY additional software, reverse engineering, tricks, or other road blocks. On Android, not only are the devices locked down, but updates often break the back-doors and hacks being used to gain root access and a new method has to be found again. And those methods vary from device to device too. Many carriers will even void your HARDWARE warranty if they discover you rooted an Android phone.

There is a BIG difference.

Re:Really Really Really? No.

[richie2000]

That is a function of the phone vendor, not the OS. On my Android phone, with a plain jane vanilla Android OS, root is just a command away. I get a screen telling me that if I root it, Google can't be held responsible for what I might mess up while being root. That's it. No additional software, reverse engineering or tricks required.

I think it is a little unfair to bash Google for what HTC, SE or Samsung does.

Re:Really Really Really? No.

[markdavis]

I could very well be incorrect, but I am not aware of ANY in-contract phone that is available from ANY carrier running plain vanilla Android Linux.

I am not bashing Google on this. I am just pointing out that Android Linux, as it exists for 99.X% of the market, is FAR more locked-down than WebOS Linux and Maemo Linux.

Re:Really Really Really? No.

[richie2000]

I could very well be incorrect, but I am not aware of ANY in-contract phone that is available from ANY carrier running plain vanilla Android Linux.

All Google Nexus 1 phones are, regardless of carrier. I don't know if there are more models that are, or what percentage of the market they have, though.

Please note that it would be perfectly possible for a carrier to lock down a Maemo phone if they wanted to. Or, a phone vendor to use Maemo as the OS (I don't know if Nokia's licensing would allow this, but let's assume so for the sake of argument) and place a lock-down layer on top (Sense, Timescape, whatever). And, in both cases it would be possible to incorporate automatic OTA updates and install functionality. Yes, having root does theoretically enable you to find and stop such attempts, but what percentage of users could and would actually do that? I suspect we'd be in the other part of your 99,x% number again.

Re:Really Really Really? No.

[kbdd]

I think you may want to revise your opinion of what your service provider can do on your phone :)

and who is the real root...

Re:Really Really Really? No.

[LynnwoodRooster]

The difference is, tweaking/replacing the OS on the N900, or any Android or WinMo phone doesn't result in you risking prosecution from the phone maker...

Re:Really Really Really? No.

[Deliveranc3]

I am installing modded versions of Android 1.6 on my phones. It comes with more features enabled than a standard version. Unfortunately Google spams me with update recommendations, if I sell my phones it's going to be hard to explain that the user shouldn't trust google updates because they will remove features, software and put users back into a walled garden.

Google is VERY close to being evil on this one, I hope they don't cross the line... a lot of geeks and nerds trusted them. And when geeks and nerds produce their best work the world gets rocked.

Re:Really Really Really? No.

[ceoyoyo]

Same as Android, same as iPhone OS.

If the N900, or any Maemo phone got sold widely by a major carrier it would be locked down so the carrier is root and you're not. Same as Android. Same as iPhone OS.

Re:Really Really Really? No.

[ezeri]

I could very well be incorrect, but I am not aware of ANY in-contract phone that is available from ANY carrier running plain vanilla Android Linux.

I am not bashing Google on this. I am just pointing out that Android Linux, as it exists for 99.X% of the market, is FAR more locked-down than WebOS Linux and Maemo Linux.

The Nexus One on T-Mobile.

Isn't Android Open Source?

[warrior_s]

Excuse my ignorance... but why is this a surprise when android is an open source OS? Why has anyone not noticed this in the source code!! Or is only kernel open source and not the other parts?

Re:Isn't Android Open Source?

[AHuxley]

Apache 2.0 and GPLv2. Open for you to fix and enjoy, closed where needed for them to fix you.

Re:Isn't Android Open Source?

[SpazmodeusG]

Pretty much only the kernel is open source and not the other parts.
The Google apps, the main interface API, and anything relating to the market are well locked down.

The Android is not a phone you should get if you want an open source phone. Try the OpenMokos.

Re:Isn't Android Open Source?

[Anonymous Coward]

Excuse my ignorance... but why is this a surprise when android is an open source OS? Why has anyone not noticed this in the source code!! Or is only kernel open source and not the other parts?

But... this *whole story* is about someone noticing. What more do you want? Of course you can always say "why didn't someone notice earlier", but at some point, you just have to accept that open source doesn't mean that everything will immediately be discovered. People still need time to go through things.

Re:Isn't Android Open Source?

[dmesg0]

Pretty much only the kernel is open source and not the other parts.

This is incorrect. Most of android is in AOSP, including the kernel, dalvik, UI, launcher, dialer, all the libs etc. You can build a fully working system from the open source components (that's how cyanogenmod is built).

Only the google-specific applications (Maps, gmail, gtalk, google market, facebook, google voice ) are not open source. Many of them can be replaced with alternatives if one wants to release a system without paying to google: e.g. SlideMe market, one of many different e-mail/gps apps, etc.

You can check the AOSP contents here.

Re:Isn't Android Open Source?

[Anonymous Coward]

The question was whether the source is visible, not if the device is locked down. Latter is bad for hacking the phone, but plays no role in someone noticing the remote installer in the source... which is what GP is about.
AFAICT it's "open" for inspection.

Re:Isn't Android Open Source?

[PipsqueakOnAP133]

Because while open source allows people to inspect the source and understand what it does, that assumes somebody actually is trying to inspect and understand the source.
Open source isn't a magical solution to make the community care about actually doing the work to improve the project. But as we see, eventually somebody noticed.

So it seems most of the community would rather use the phone than read the code. Not that surprising, isn't it?

What I find most interesting is that the security researcher's test app was a benign test for a rootkit bootstrap. To me, his results seems to imply:
1) At least 200 people don't read, understand, or care about the permissions warnings, in favor of "ooh, Twilight! *swoon*"
2) If the rootkit bootstrap worked, the app removal process depends on Google asking a rootkit-compromised phone to be trustworthy enough to remove the app. Isn't that kinda silly?

Re:Isn't Android Open Source?

[ceoyoyo]

And the baseband code. You can't build a fully working system from the open source components. The most important bit is completely closed.

Re:Isn't Android Open Source?

[dmesg0]

We are talking about Google Android code here, but the baseband code does not belong to Google.

Even OpenMoko phones (Neo Freerunner) come with a closed baseband.

You don't really need open source baseband to build a system, but theoretically, when OSS baseband exists and is good enough (OsmocomBB is not yet there AFAIK), there should be no problem to adapt it to android.

Re:Isn't Android Open Source?

[ceoyoyo]

If you want to build a fully open phone, you need open baseband. Otherwise you dont have a phone. Many would say it's the most important part, since it's the baseband code that, for example, locks the phone to a particular carrier. In particular, people who like to compare the iPhone to android constantly confuse jail breaking, which is something Apple doesn't really interfere with much and is just like rooting, with unlocking, Which Apple does regularly interfere with, just like every other carrier/manufacturer.

So yes, there are NO open source phones. The most important part is missing.

Re:Isn't Android Open Source?

[dmesg0]

Apple's OS upgrades regularly break both jailbreaks and unlocks, because they don't want either of them (and jb is often prerequisite for unlocking).

Anyway, my original reply was to someone claiming android code is not open source at all, but I never proposed building fully OSS phone with it. You still need proprietary baseband and often some proprietary hardware drivers.

But if you really insist, you can try building an OSS tablet (no cellular radio), it should be a little easier ;)

By the way, finding fully open hardware is not an easy task at all, not just with phones. Very often some card comes with a nice linux GPL-licensed driver, but upon a closer examination the driver is just a tiny layer between the OS and the card's firmware. The firmware is of course closed, and when it starts misbehaving you don't have a lot of options to fix it.

Re:Isn't Android Open Source?

[ceoyoyo]

You replied to me, and I replied to you. You said this:

"Only the google-specific applications (Maps, gmail, gtalk, google market, facebook, google voice ) are not open source. Many of them can be replaced with alternatives if one wants to release a system without paying to google: e.g. SlideMe market, one of many different e-mail/gps apps, etc."

This statement is not true. The baseband is not open source. The baseband is what makes a phone a phone, and is responsible for many or most of the restrictions that phones come with. We're not talking about hardware - we're talking about software, which interfaces with common, off the the shelf hardware, and is specifically designed to restrict use. But sure, I guess you can run Google's phone OS freely if you want - just not on a phone.

I'm not a free software zealot. I think proprietary software is important, and is a valid choice for someone choosing how to release his or her work. I do think the free software movement is making a mistake vehemently attacking all things proprietary on the desktop while there aren't even any open source alternatives for phones and proprietary software is actually being used there to restrict people's freedom.

As for the iPhone, Apple doesn't seriously try to block jailbreaking. Sometimes a method stops working because they patched a vulnerability, but a jailbreak is frequently available for a new version as soon as it is released. Baseband updates usually take weeks or months. The developers of Pwnage tool recommend always installing updates through their software so you can update the OS, pre-jailbroken, and not the baseband. Apple hasn't even changed the well-known root password since one of the first updates!

Re:Isn't Android Open Source?

[Mr2001]

As for the iPhone, Apple doesn't seriously try to block jailbreaking.

This statement is not true, unless you consider trying to have jailbreaking declared illegal non-serious.

verizon does this to my blackberry

[circletimessquare]

one day you look at your phone: hey, there's a bing icon

couple of months later: look at that, a skype icon

it's vaguely unsettling, to be reminded of how raped you are in terms of privacy

Re:verizon does this to my blackberry

[Anonymous Coward]

I'm sure any day now Google will install Bing on all their phones.

And what does "vaguely unsettling" even mean? You find rape to be just "vaguely unsettling?"

I don't know what Google plans to do with this, and I don't particularly care (my phone just makes *gasp* calls). Rape is forced upon a person. If Google does something you don't like get a new phone. Google isn't coming to your house, pinning you down, and forcing to you to use Android. Or in your case, Verizon. So Verizon is raping you and yet you keep it. Is it rape when you say, "ok let's do this." Dump your BB and get something else. If you personally refuse to do so and accept what they do to you then it ain't fucking rape.

Re:verizon does this to my blackberry

[uvajed_ekil]

Please cut out any rape or nazi analogies, okay? This is "vaguely unsettling," while there is nothing vague or merely unsettling about rape. That shit is not cool. And if you install a Bing icon, which Google is pretty unlikely to do any time soon, you deserve to be raped by nazis anyway.

Re:verizon does this to my blackberry

[Anonymous Coward]

one day you look at your phone: hey, there's a bing icon

couple of months later: look at that, a skype icon

Actually, Verizon CAN'T push out applications to your blackberry. No carrier can.

You might recall when Etisalat (a carrier in the United Arab Emirates) wanted to install spyware on all blackberries in the country.

They had to trick users to install the software manually, because the carrier couldn't do it themselves.

What Verizon is doing is pushing out an icon, and then you can click on the icon to download & install the application. The icon isn't the application itself.

You can even block these icons from your blackberry enterprise server, it's under "browser" and "allow application download services". Set this to false.

it's vaguely unsettling, to be reminded of how raped you are in terms of privacy

You aren't, because you have a blackberry. The blackberry platform has been tested & certified by many governments & non-governmental organizations.

Iphone, android, symbian et al haven't been certified by anyone.

Re:verizon does this to my blackberry

[Anonymous Coward]

Just wait until they brick your phone, and disclaim any responsibility.

Or a competitor bribes someone to install key/screen sniffers.

Or someone in authority coerces someone to push kiddie porn to your phone.

The avenues for abuse of someone who has given away their responsibility and power seems endless..
Soon to come to every phone in the "civilized" world.

I hate this s**t.

[Anonymous Coward]

I'm a smartphone user, although maybe not a smart one. I have an iPhone 3GS. I'm technically adept, although perhaps not in areas that the Slashdot crowd would consider valid or useful. So, although I programmed flight data acquisition and control systems in assembler running on Z80 hardware in neolithic times, I admit I don't have nearly the fine-grain understanding of current phone OSes that it would appear one needs to evaluate and protect oneself from the (IMHO) vendors' overreaching control imperatives. I don't want my phone OS vendor to be able to install an application without my consent. I don't want my phone OS vendor to be able to remove an application without my consent. I want the mix of applications running on my phone to be up to me, not the vendor. Is that so very unreasonable? More and more, my choices with respect to control over my phone narrow, and the only obvious escape lies in open source systems, which require an investment of time to learn that is prohibitive for me. Honestly, as much as I love new technology, it offers less and less convenience and more and more of a drain on my time to administer. It makes me appreciate the efficiency of, well....you know....just a simple phone? And you can get off my lawn now.

Google IS Evil

[Anonymous Coward]

USAF Training Exercize above Navada:

Pilot: Wait just a darn minute ... these Coord are for Mountain View, California!

Nav Ofc: Yes Sir. Mountain View, California. Afarmitive. Just a Sec ... looks to be the Google, Inc. Offices located in Mountain View, California. That's a Confirm, Sir.

Pilot: Shoot! Looks like those Ruskies have done a "End Around" on our Left Flank. Dang, I truly hate Shit like this! But, it is not our moment to judge or question or orders, but to do and diliver Hell on the Enemy!

Pilot: Ordinence Ofc, bring online bays 2 and 4, make it snappy we don't have much time!

Ordinence Ofc: Rodger that. Bays 2 and 4 are online and answering.

Pilot: Ordinence Ofc. commence prelim arming ordinence Joker and Queen, over.

Ordinence Ofc: Rodger that. Joker and Queen have Prelim Arming.

Pilor: Comm Ofc, are we recorded? Over.

Comm Ofc: Rodger that. All Comm links are being recorded for future review.

Pilot: Rodger that. As Pilot, I'm inserting my command key, ... truning, ... unlock of firing mechanism acknowledged by the SRB 171, now keying in firing code, ... SRB 171 acknowledges firing code, ... Ordinences Joker and Queen are acknowledged ... lock-on sequence acknowledged, ... lock-on sequence commencined!.

Pilor: Nav Ofc, bring us round on heading 266 TANGO, repeat, 266 TANGO, over.

Nav Ofc: Rodger that. Heading set to 266 TANGO, repeat, heading set to 266 TANGO.

Pilot: Ordinence Ofc set prelim ignition at 5000 ft, repeat, set prelim ignition at 5000 ft.

Ordinence Ofc: Rodger that ... Prelim ignition set at 5000 ft, repeat, Prelim ignition set at 5000 ft.

Pilor: Ordinence Ofc set primary ignition at 2000 ft, repeat, set primary ignition at 2000 ft.

Ordinence Ofc: Rodger that ... Primary ignition set at 2000 ft, repeat, primary ignition set at 2000 ft.

Nav Ofc: TARGET IN SIGHT ... TARGET IN SIGHT ... 30 SECONDS TO DROP ... REPEAT ... 30 SECONDS TO DROP.

Pilot: Ordinence Ofc arm Joker and Queen.

Ordinence Ofc: Joker and Queen armed, repeat, Joker and Queen armed.

Pilot: Mantinence Ofc open bomb-bay doors.

Mantinence Ofc: Rodger that, Bomb-bay doors open, repeat, bomb-bay doors open.

Comm Ofc: Sir, EMC transmission incoming, repeat, EMC transmission incomming. Request ot decode, repeat, request to decoy.

Pilot: Request to decode affarmative.

Comm Ofc: Sir, the EMC is from the Executive Office of the President ... It reads ... Burn'em all.

Pilot: YYYYYEEEEEEHHHHHHAAAAAA!!!!!!!!!!!!!!!!! Payback boys! Those hippies are goin'n to be running in the streets burn'n from head to tail just as this party starts.

Nav Ofc: 10 Second to drop, repeat, 10 seconds to drop, on, MARK.

Pilot: 9 ... 8 .... 7 ... 6 ... 5 .... 4 .... 3 .... 2 .... 1 ..... 0 [CLICK].

Pilot: TURNING TO HEADING 345 SHARP ... THRUSTING TO 105 PERCENT ... NOSE DOWN 2 PERCENT ... HERE SHE CUMS BOYS ... WE'RE SURF'N A THERMONUCLEAR SHOCKWAVE NOW.

Government mandate?

[Anonymous Coward]

Is it possible that remote installation/removal could be a government mandate?

This is great news

[OrangeTide]

Because Android is still less evil and invasive than iOS.

I'm not trying to troll, but really. if you compare the the two platforms one is mostly open and one is glued shut.

Re:This is great news

[iluvcapra]

I'm not trying to troll, but really. if you compare the the two platforms one is mostly open and one is glued shut.

I'm not trying to troll, but really; if you compare the two platforms one is mostly bought and paid for by the handset purchaser, the other is free to the consumer and OEM but is distributed with the intent of selling mobile eyeballs to advertisers. What could possibly go wrong?

Re:This is great news

[OrangeTide]

are you trying to establish some causal relationship? because I don't follow.

Re:This is great news

[aitan]

Can you explain to me which one is the free one?

Because last I've heard you can't get any of those phones for free unless you get into a 1 or 2 years contract, no matter if you pick Apple or Android.

And Google has its AdSense program, meanwhile Apple has the iAds.

So what are the differences?

Re:This is great news

[fishexe]

I'm not trying to troll, but really. if you compare the the two platforms one is mostly open and one is glued shut.

I'm not trying to troll, but really; if you compare the two platforms one is mostly...

I'm not trying to troll, but really: "I don't want to sound like a queer or nothin', but I'd kinda like to make love to you tonight."

Re:This is great news

[Jesus_666]

If you compare the two platforms, one has an open.source kernel and a closed-source userland and the other has a closed-source everything. Unfortunately, application management is not a kernel module in Android so the fact that Android's kernel is open doesn't help you a single bit.

Plus one can argue the iOS is much less invasive than Android as Apple doesn't seem to have the capability to do anything to apps already installed on your iPhone. There are plenty of people who still happily run apps that Apple has long kicked out of the App Store for violating the TOS. iOS is less easy to install random apps to but on the other hand gives the vendor and mobile provider less power over your phone - so in essence, Android gives everyone more power and iOS less. Which you prefer depends on how much you expect third parties' willingness to exploit you (in the business sense) for money and whether you consider safety a more important feature than the ability to install arbitrary software.

Re:This is great news

[Ash-Fox]

Plus one can argue the iOS is much less invasive than Android as Apple doesn't seem to have the capability to do anything to apps already installed on your iPhone.

Actually Apple can blacklist certain applications from running if they wanted - This has been mentioned before.

Which you prefer depends on how much you expect third parties' willingness to exploit you (in the business sense) for money and whether you consider safety a more important feature than the ability to install arbitrary software.

Of course, the advantage with Android is that if you don't like your current setup at all, you can install one of the many other rom modifications out there available that are to your liking.

Re:This is great news

[iluvcapra]

If someone makes money by selling a good phone they'll continue making good phones. If someone can't make money by selling good phones, but can only make money through adsense, they'll primarily focus on improving adsense. If remotely installing and deleting software pisses off the customer, the first guy probably won't do it, but the second guy probably will as long as it doesn't significantly affect ad revenues, since that's who pays him.

Google didn't open-source Android because they like you or because they are cool, they did so in order to spread the reach of their advertising platform and services. That's it's purpose. Apple (or Palm or RIM for that matter) has a lot more to lose from an angry end user than Google.

Re:This is great news

[Anonymous Coward]

Google doesn't sell Android phones. HTC, Motorola, Samsung, and others do. They make tons of shit phones that sell because they are cheap, they also make many smartphones that are expensive but high margin so worth the investment for them. If customers buy Android phone A and it screws them over, they are as likely to try Android phone B from another manufacture that addresses their specific concerns. Android is not a complete phone platform, it is a toolkit for making the software that runs on a phone. It is more like a distribution in the Linux sense and less like an OS in the iOS/iPhone sense.

The model for Android is not unlike WinCE/Window Mobile. Vendors apply their own tweaks and changes to the system, and while Microsoft has a lot of say over what you do with the OS you licensed there is still quite a bit of wiggle room. Apple doesn't license their OS to anyone else, you are left to the whims of Apple. Comparing that to Google, which is actually only a minor player in what it takes to deliver a working Android phone, is laughable.

Thank you for the exploit, sir.

[Khyber]

I know of several countries that will be interested in this.
And I'm already halfway through the security around that code.
This is a cakewalk compared to cracking the PS3 hypervisor.

Re:Thank you for the exploit, sir.

[TheRaven64]

Exactly my thought. It's not like Google has never found their servers compromised by China, for example. I'm surprised that the US government isn't a little concerned that Google has just potentially handed China the ability to turn every single Android phone into a bug. I wonder if this is part of the reason why GCHQ does not permit Android phones for government use in the UK...

Re:Thank you for the exploit, sir.

[IamTheRealMike]

How is this different to Windows Update?

Do You Agree

[dadioflex]

If you clicked on the terms and conditions, and this was in them, well...

If you didn't, or this wasn't in them, well... I'd be incredibly surprised.

It's not what Google would do with it...

[mlts]

It is what a blackhat would be able to do if they were able to find Google's private key.

Re:It's not what Google would do with it...

[Spad]

Or what they could do with Windows Update if they were able to find Microsoft's private key.
Or with the iPhone if they were able to find Apple's private key.
Or Ubuntu with Canonical's.
And so on.

Re:It's not what Google would do with it...

[mlts]

Windows Update can be turned off if worse came to worst. With repositories, people can be told to load a different key.

With a super-root key that has access to features that even the device owner does not possess, there is absolutely nothing anyone can do other than discontinue use of their device.

Even if someone got momentary access to the key (a hacked account on a HSM), the damage would be immeasurable, and hard to fix. Push out a package that disallows future updates via that channel, changes the private key to the blackhat's and then start polling a server array so the malware can download a payload such as a bogus ROM image and so on.

Umm, updates?

[drewhk]

How is this different from automatic updates? Is it initiated by the phone (pull), or by a remote entity (push)? Is it usable by 3rd parties?

Version Name

[codecore]

2.75 is not Double Chocolate Chunk Cookie. It is Maple Bar
2.80 is Jelly Donut
3.0 is Insulin Shots

There is a way around the Market

[asnelt]

It is scary that Google doen't provide an opt out option in the Market app. But there is a way out, at least if the Cyanogen mod is available for your phone: Install the Cyanogen mod without the proprietary Google bits (incudes Market app, Gmail app, text-to-speech etc). I just checked it. The vending apk that is responsible for the OTA removal/install functionality (according to http://jon.oberheide.org/blog/2010/06/25/remote-kill-and-install-on-google-android/) is not running on my N1. I get along pretty well without the Market. You can install your apps directly from some download site or you can install apktor which allows you to access public repositories.

It could also allow government backdoors too

[Stu101]

Here is a quick thought on this one. Say you are some big drug pusher and you get a "clean" phone from retail. The US government is sure going to be interested in the contents (stuff they can't get by going to your telco). How can they get all the info? Install a silent trojan. Who can do that, Google of course.

It could be quite interesting to do a FOI to see how many times it has been done (Because I am pretty sure it will have been done by now)

Just think of it as a built in rootlkit

[Tangential]

Hmmm. This sounds more like something M$ or Apple (or especially SONY) would do.

Re:They also removed the restraining bold from C3P

[JaredOfEuropa]

Exactly, and he did so first!

I would have thought this was obvious...

[Genda]

This is how Google will insert the HYPNOTOAD onto your android phone... ALL GLORY TO THE HYPNOTOAD!...

Don't be evil

[gilesjuk]

It's funny how Android owners see the platform as an antidote to Apple's restrictive App Store and other restrictions. Google are just as crazy and dubious as Apple at times.

One can only hope HP manage to do something with Palm. Although the biggest obstacle to that is the fact it will only be on HPs hardware. Lets face it they've not released a good smartphone or PDA in a while.

Who pays for the bandwidth!

[KreAture]

If someone installs something on my phone at $2/MB I demand they pay for the bandwidth they use!
I did not choose to install the software while on 3G or whatever so why should I be billed for it?

Priorities

[Andy Smith]

Meanwhile my Android phone just had its first over-the-air system upgrade, losing some of my settings and clearing my entire 7-screen desktop.

Rather than Google worrying about remote app installs and remote app removals, what would be great is if basic things like minor system updates didn't practically reset the damn phone to factory defaults.

My good lady had a similar problem with her iPhone system update a few days ago -- it deleted all of her contacts.

Pretty rubbish technology we're dealing with here :-(

Do no harm

[Anonymous Coward]

Let me get this straight:

The Evil Empire
Allows me to force them to ask to install updates.

The No Harm Guys
Know better than the world and exercise their paternal rights.

What's need is some guy running down the isle with a sledgehammer!

Wasn't this in the Froyo presentation?

[Mascot]

Google has demonstrated that, beyond Froyo, they will add the ability to browse the Android Market and have your phone to install a given app right from the Market by triggering an intent via push message.

How is it shocking that this intent exists prior to the functionality being fully implemented?

At about 31 minutes in: http://www.youtube.com/watch?v=IY3U2GXhz44&feature=channel

Re:They also removed the restraining bold from C3P

[Anonymous Coward]

No wonder 3PO was such a wuss - they took away his bold!

You don't anything anymore...

[foupfeiffer]

Considering that property ownership means "lease until you stop paying property taxes to the City/State/Feds" or "eminent domain" Kelo v. City of New London ...

And if you "own an OEM license for an operating system" that is "non transferrable to another machine" ...

It's not surprising that the "phone you buy and own" is actually controlled by the Manufacturer and can be modified by them over the air at their discretion:

Pertinent examples:
Syrian Radar: http://spectrum.ieee.org/semiconductors/design/the-hunt-for-the-kill-switch/0
Kindle's Orwellian book deletion: http://www.nytimes.com/2009/07/18/technology/companies/18amazon.html
iPhone

This fits the "subscription model" that anti-virus, browser, and now operating systems all use to ensure steady cash-flow and hopefully phase out that frustrating "buy it once" legacy mentality that is also symptomatic of people who don't use credit cards.

I strongly suggest periodically researching alternatives to large corporations that ignore your rights or sense of ownership - i.e. try a different browser (firefox/opera?), a different search engine (hakia.com) , and hopefully somebody will fork Android like Centos does a wonderful job for Red Hat (and then post it on Sourceforge / slashdot).

Anonymous

[Anonymous Coward]

What about removing malware from the Android Market?

My response

[hey!]

I cast "root device" then "alter /etc/hosts".

Re:My response

[wampus]

It's super effective!
Gmail has passed out!
Google Maps has passed out!
GTalk has passed out!
Contacts is poisoned!

Trivial Fix

[fishthegeek]

I can't see how this would be an unsolvable issue for anyone here. I started with a G1 and now have a Nexus One. I rooted the G1 and installed Cyanogen's Rom which completely removed the big G's ability to update my phone in any way. It's even more trivial to do that to the Nexus One than it was the G1. While most people won't install a custom rom on their phones, at least for the anointed Google phones the process isn't hard and nicely takes care of at least a few privacy concerns should you have them. T-Mobile doesn't care if an owner does this and neither does Google. YMMV on other carriers. On the flip side, while I care about privacy I have to admit that the location service offered by giving up a little privacy are very useful to me. A cab driver has to be able to know both where you are and where you want to go in order to provide service and location services are a lot like that. Turn them off when you don't need them.

Eek!!!

[macs4all]

Eeeek!!!!!

Just One More Reason

[fast turtle]

to stick with a basic phone. No installs, no web, nothing but phone

Blackberry has as well

[rrossman2]

This is nothing new. The Blackberrys have the push feature for both service books as well as applications. It may be referred to as an "update", but there's been times where, on a restart or even without, a new "application" appears on my home screen

I might be wrong, but...

[Reilaos]

Don't most rooted phones not have this sort of worry? I could have sworn that most of them disabled at least the OTA update capabilities so that rooted phones didn't get suddenly un-rooted or updated with things that conflict with your own changes.

People, its a PHONE

[nurb432]

Of course they have these abilities. That should go without saying.

Re:They also removed the restraining bold from C3P

[Anonymous Coward]

I always knew C3PO was a lion somewhere deep inside of him...

Google is oggling you!

[Anonymous Coward]

chumps

Defeating this sort of thing on GSM phones?

[cool_arrow]

I recently discovered something called a "Turbo SIM" located here: http://www.bladox.com/index.php?lang=en It is essentially a tiny microcontroller that sits between your mobile handset and your SIM card(sandwiched). The GSM standard allows network operator approved apps. to run from within the SIM. It is called "SIM toolkit" or STK. Only big business (banks etc) seem to run apps in this STK mode. The TurboSIM makes your handset think your own apps are on the SIM. The programmability of this gadget is cool as the GSM standard says that when the legit SIM is booted up it queries the hardware to find out what its capabilities are and a string of bits are returned from the handset to the SIM. One of these bits indicates whether or not the hardware is capable of OTA updates. Capturing this data and spoofing it would be trivial it would seem and is being done for other reasons (look at the forums). Something to think about.

Meh...

[mweather]

If it bothers you, comment it out.

For corporate use?

[PhilHibbs]

Maybe this is for corporate customers who want to push corporate apps out to all their devices.

Re:Are we reading the same Slashdot?

[jo_ham]

No, we're obviously not reading the same slashdot. Negative Apple press on slashdot is overwhelmingly troll and fud-like, often with wilful ignorance and ludicrous non-sequiturs - much like Google's negative press.

LOL

[circletimessquare]

you're a funny one

Why bother asking ....

[jobst]

its been in (nearly all) other OS's for years.

Energy Savings Widget

[krischik]

On the Energy Savings Widget is an option to switch off background network operations. You did not click that off there when you left your homes Wifi range? Then odiously you have agreed to have software installed over 3G!

Yes, I too would prefer a background network operation over WiFi only option.

Google already told us they could install apps.

[OzJD]

Am I the only person on Slashdot that thinks that features like this are there for a good reason? Remember how Google announced (at Google I/O 2010) that they were going to allow users to browse the market and install apps directly from a PC, without needing the device connected? Well, how do you all propose that this works without Google being able to install apps on your behalf? A confirmation message on the phone every time you attempt to remotely install an app would be a pain IMO, and render this feature useless. This article just promotes FUD, and isn't really news. Maybe if it was posted before Google announced the feature at I/O 2010, then we should get worried.