Slashdot Mirror
Google Has Android Remote App Install Power, Too
Trailrunner7 writes "The remote-wipe capability that Google recently invoked to remove a harmless application from some Android phones isn't the only remote control feature that the company built into its mobile OS. It turns out that Android also includes a feature that enables Google to remotely install apps on users' phones as well. Jon Oberheide, the security researcher who developed the application that Google remotely removed from Android phones, noticed during his research that the Android OS includes a feature called INSTALL_ASSET that allows Google to remotely install applications on users' phones. 'I don't know what design decision they based that on. Maybe they just figured since they had the removal mechanism, it's easy to have the install mechanism too,' Oberheide said in an interview. 'I don't know if they've used it yet.'"
Google has been taken over by Jawas.
So how long until we see someone attempt to exploit this?
Slashdot headline would have been:
"Evil Apple Hides Secret Rootkit Installer on All iPhones"
I'm sure someone could create a honeypot wifi network that forces all Android devices that connect to it to install a particular app.
Not unless they manage to compromise SSL in order to make the phone think it's talking to Google when it really isn't. If someone manages to do that, we have much bigger things to worry about than a malicious phone app.
Visual IRC: Fast. Powerful. Free.
You mean they can remotely install apps over the air just like every other modern phone on every other carrier I've ever seen?
This is a non-story -- OTA install is pretty much required by every carrier out there so they can force you to upgrade your phone.
Yeah because wardriving is soooo terrible. Look, if you don't want people connecting to your wi-fi network hide the SSD and encrypt it securely. If not, then does it matter too much if you lose a few bytes of data? There are very, very, few people who are going to bother even trying to break an encrypted connection, especially when they can go to a cafe and get free internet pretty much everywhere.
Taxation is legalized theft, no more, no less.
Really, this makes a bit more sense than having 234234234324234 OS updates every year. The majority of updates can be done by removing/updating apps, not to mention security patches. Really, some phones already have the latest Android they will ever get, barring rooting. But people will keep using that phone for 4+ years, that is a long time to have a security flaw out there that could steal information. Since the browser is going to be the main attack vector which is an app, it makes sense.
While this could be used to push more carrier crapware, I think updates and upgrades of installed apps are more likely to work for more phones and easier for the average user to use.
In all honesty, would you rather be using an outdated version of a browser with security flaws because your phone doesn't support Android 2.75 Double Chocolate Chunk Cookie or just have your browser update to a more secure version OTA?
Taxation is legalized theft, no more, no less.
...when Slashdot raises a stink about them removing it.
"Oops. Sorry. Here's your keylogger back."
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Does anyone remember the android demo at Google IO where they showed the remote install feature from the android market on a desktop browser in froyo? Seriously, just because there is remote install functionality in the OS doesn't mean that it's there for malicious or secret use -- it's most likely part of a user facing feature.
It was Luke who removed the restraining bolt from R2D2.
It is no coincidence that in no known language does the phrase 'As pretty as an Airport' appear.
My "most modern phone", the N900, is not bound to any carrier, and I am quite certain that my carrier does not have the ability or a clue how to install anything on it. I'm root. Not them.
Apple and Android folks: Enjoy being someone else's bitch.
Was this post obnoxious? Yes, in a very nerdy way.
You know, we actually have a secure WiFi encryption protocol now. It is called WPA.
Excuse my ignorance... but why is this a surprise when android is an open source OS? Why has anyone not noticed this in the source code!! Or is only kernel open source and not the other parts?
You're just flat wrong. WPA isn't compromised in any way even remotely as badly as WEP was/is.
WPA:TKIP can, in certain cases with certain AP's allow one to inject packets into the network. Packets won't come back to the attacker.
Perhaps one can use that as a way to leverage some additional resources to attack a network. Certainly, I wouldn't feel good with someone being able to inject packets - but it's not a game-over exploit like WEP was.
WPA-AES: There's simply no known attack against the cypher. You might be able to brute-force the key - but that's an issue of any shared-secret system - it doesn't have anything to do with the crypto in WPA:AES. The solution is to use a large key-space (all ascii characters, not just uppercase alpha's for example.) and long-ish. 10 chars or more. Bonus points for more random and less guessable secrets.
So, IMO, to claim "...it's not that much more secure than WEP was when it was introduced." is really a massive overstatement due to ignorance, at best or just plain falsehoods at worst.
one day you look at your phone: hey, there's a bing icon
couple of months later: look at that, a skype icon
it's vaguely unsettling, to be reminded of how raped you are in terms of privacy
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Google wanted control so they pushed http://en.wikipedia.org/wiki/Android_(operating_system)
GPLv2 to bait you in, Apache 2.0 to close you down if needed.
You write the 'free' apps, hunt bugs, preach about the 'freedoms', Google tracks, sells ads, data mines, a push and profit with a sting in the tail it seems.
Domestic spying is now "Benign Information Gathering"
I'm not trying to troll, but really; if you compare the two platforms one is mostly bought and paid for by the handset purchaser, the other is free to the consumer and OEM but is distributed with the intent of selling mobile eyeballs to advertisers. What could possibly go wrong?
Don't blame me, I voted for Baltar.
It is what a blackhat would be able to do if they were able to find Google's private key.
Exactly my thought. It's not like Google has never found their servers compromised by China, for example. I'm surprised that the US government isn't a little concerned that Google has just potentially handed China the ability to turn every single Android phone into a bug. I wonder if this is part of the reason why GCHQ does not permit Android phones for government use in the UK...
I am TheRaven on Soylent News
Exactly, and he did so first!
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
I cast "root device" then "alter /etc/hosts".
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.