Slashdot Mirror
Android Data Stealing App Downloaded By Millions
wisebabo writes "A wallpaper utility (that presents purloined copyrighted material) 'quietly collects personal information such as SIM card numbers, text messages, subscriber identification, and voicemail passwords. The data is then sent to www.imnet.us, a site that hails from Shenzen, China.'"
I'm going back to winmo where it's "Safe!"
My abilities are only limited by my imagination
A wallpaper APP? Why would you need an app? It can't just display a jpg as wallpaper?
Free Martian Whores!
This is a very good reason to run Droidwall. However, the bad news is that Android apps are going to a model where they ping one of Google's servers to check if they are licensed for that user. Of course, Droidwall can be updated to allow any apps to connect to that server farm's IP address range even if they are disallowed from anywhere else, but that may take some programming.
Droidwall also requires root access.
According to this [http://phandroid.com/2010/07/29/another-app-stealing-data/].
"Your voicemail's password is also not transmitted unless you included the password in your phone's voicemail number field."
It is by my will alone my thoughts acquire motion; it is by the juice of the coffee bean that the thoughts acquire speed
What was the NAME of this evil app? Neither TFS nor TFA bother to tell us that. We got the Dev Name which is almost as good, but geez.
God help anybody who used facebook and this app... there's every chance they will get home tonight and find an imposter in bed with their wife.
Reminds me of advertisements in magazines where you text a code to a phone number, and they send you a wallpaper and sign you up for a subscription. Nope, they won't be sending you any text spam. Not a single piece. ::wink wink nudge nudge shank shank::
Living With a Nerd
This is one good reason to have a unified app service, where all the apps are first vetted before they are released. I think mozilla's addon collection is a good model to follow.
In other news... stupid people get tricked by stupid tricks, rain is wet, and dry erase markers smell amazing.
So basically, -1 troll/offtopic is really slashdots way of saying "I hate that you thought of something before me."
an apple lover, but I believe there is a reason other than money, why appstore exists. It's because it offers people prevention exactly from cases like this one. ... and makes the platform "well bred".
I am surprised, shocked, and dismayed to see a fine journalistic source such as Slashdot stoop to yellow journalism, as it were. There is absolutely nothing suspicious about the origin of the website being being in Shenzen, China and the summary's implication of this is absolutely untoward. I expect a full apology posted immediately, then duped again tomorrow.
A NYC lawyer blogs. http://www.chuangblog.com/
Do you really need to know the name of the app in order to avoid it? I think that you should know well enough to avoid wallpaper apps! Those (and screensavers) were something like number 1 way for viruses to spread on computers in the late 90s or so. The same people who fell for those then can now afford expensive phones and fall again for the same scam.
A screensaver with a virus?
Even if they're told exactly what the app will have access to, people will click through anything.
Update from TFA:
Update: Lookout notes it does not capture browsing history and text messages: It collects your browsing history, text messages, your phone’s SIM card number, subscriber identification, and even your voicemail password, as long as it is programmed automatically into your phone.
Looks like it doesn't collect browsing history and text messages after all.
Developers bitch about the app store approval process but this is exactly why it exists. Yes it would be nice to sever ties with the app store but apple is doing a fairly good job of protecting it's ecosystem.
Got Code?
The original VentureBeat article claimed the wallpaper app had been downloaded 50k times. So where is the new figure from?
"There is more worth loving than we have strength to love." - Brian Jay Stanley
When I read TFA, I saw the part where 47% of Droid apps use third party coding, and 23% of Apple apps also use it. Then I realized, there's no safe place to hide. I like my walled garden, but even that has leaks.
Here's to hot beer, cold women, and Glaswegian kisses for all.
This is sort of like the early days of MS-DOS, back when everyone trusted everything they downloaded.
Although Android apps do run in a security "sandbox" whereby they can't access the user space of other apps (see http://developer.android.com/guide/topics/security/security.html for more information), they can and do access the general configuration information of the phone such as personal data, phone calls, and SIM information, and some apps obviously need to use the phone's dialup or networking capabilities.
At install time, the user is shown a list of resources the app will access, but since most apps need at least some resources on the device to be useful, we are all in the habit of just clicking past this screen and installing, and then hoping the app is not malevolent in some way.
I think there needs to be some sort of sandbox where apps can reside prior to full release into the wild. Probably, most users won't understand how to use such a feature, but knowledgeable users would make use of it, and ultimately it would help promulgate security concepts into the general consciousness. Power users who write reviews and prominent blog pieces on Android will be able to help guide the masses to safer use of apps.
it's = "it is"; its = possessive. E.g., it's flapping its wings.
I think it's time to explore the happy medium between the "Big Brother" Apple vision and the "Wild West" that is the Android marketplace... this is the type of bad PR that can & should change some policies.
I remember looking at the permissions required required for this background image application thinking, why could a wallpaper application really need my contacts, location, browsing history etc..
If you live and breathe technology like we do, it was obvious that this application was spyware.
I've got the "Lookout" application on my phone, both for the location based phone recover, backup, and antivirus. I wonder if the company will one day use my backups for profit, sleaze, or stupidity.
At the end of the day, life is insecure. I fret over every application I install to my computer. The same is true of my phone. I also assume that the government already reads all my text messages.
I don't begrudge Apple for keeping a close eye on application store. I just insist on the kind of flexibility and power that android applications have.
You won't find a text message reading background application on the iPhone app store. You also won't find a replacement for the home screen, because Apple doesn't approve of that.
You win some, you lose some.
It's too bad that malicious people have to ruin an open-source forum like the Android with crap like this. I can see why Apple scrutinizes over the application approval process because I'm sure this is one concern on top of just being plain difficult about the whole matter.
I guess don't have a criminal mindset and have put my tomfoolery hat away, it's bad enough having hack and malicious threats on the computer level, now my phone? I miss the days of my 2x10 backlit serial display analog cell phone that did nothing more than dial a phone number.
The platforms may vary but at the end of the day, this is just yet another stupid article about stupid people giving away their private data because they did something stupid. Since we, or at least anyone in IT, engineer and support alike already know that stupid people do stupid things why are these articles considered "news worthy" here? Is it meant to inspire us to come up with our own interesting ways to dupe stupid people? Surely we get enough reminders in our day to day that we don't need them for that.
Two of my imaginary friends reproduced once
let the down-modding begin! adios to your score. you can't go into an android thread and start saying private API's are a good thing. recipe for disaster. Open is god! Open is right!
Looking at one of these apps ("Dark World Wallpapers") the app asks for the following permissions:
- Storage - modify/delete SD card contents
- Your location - coarse (network-based) location
- Network Communication - full Internet access
- Phone calls - read phone state and identity
It's nice android warns what permissions an app needs, but some of them (especially the "Phone calls" section) could be worded better to make it clearer what an app can potentially do.
(Deep voice): Hahahahahahaha we got them my minions
I'm here for the experience, not the Hyperbole.
It's Shenzhen, not Shenzen. And note to gweilos: 'zh' is pronounced roughly like a 'j' in 'Benjamin'.
I support the Slashcott and will not be reading or commenting from 2/10/14 to 2/17/14. Beta is steaming pile of dog shit
people that installed that app are just stupid... I don't mean you... I mean people.... there should an app something like 'faceplant' counting how many apps you have that require permissions for thing that they aren't suppose to do...
This is also a good reason for companies like Apple, Microsoft and Intel to work towards integrating strong encryption in their own products to prevent the free development of applications for any computers, handheld or otherwise. In essence, all computers should be like iPhones and Xbox360's. Only by locking down the software and making sure no one can freely develop apps can we prevent the scourge of malicious applications! This is why I oppose all open source development, as well. When you use an "open" platform where there is no centralized authoritarian approval process, you are in essence, promoting malicious software. Linux is used by hackers, for example. This has to be stopped by whatever means are necessary.
Right. Because that's worked so well. Keep in mind that these refer to apps that made it through the vetting process.
Knees jerking much? The parent mentioned Mozilla's add-ons, not Apple's App Store.
Also, you should note that the stories you're linking to are about the hacking of iTMS accounts for the abuse of a community rating system, rather than rogue spyware apps stealing personal data.
I personally don't know whether Apple's approval process or Mozilla's add-on review process has a better or worse record or screening out such things, but if you're going to go all "linky! looky! Apple has apps with these problems too!" you should make sure that you're talking about the same thing as the article. Or the parent comment you're responding to.
Tweet, tweet.
tell everyone!
Oh and wallpaper apps are trouble... but just about everybody knows that right?
someone named "Job Stevens"
"Waste not one watt!" - CZ
OK: there is still an opportunity for new apps, or recent 'urgent' patches, to do evil before they have been looked at, but the risk is greatly reduced.
Apple's private API setup would work for geeks IF they put a checkbox in the config like Android does for app installs to allow 3rd party utilization. Walling off the API is fine if I can override the manufacturer's wall if desired.
Now they can use their Remote Application Removal feature.
"If fifty million people say a foolish thing, it's still a foolish thing."
Okay, so the iPhone vetting process sucks and the Android is to easy to install malware.
I've noticed that with chrome, each extension I install asks for permission to use a specific list of services. I'm assuming that if they try to use a service that they haven't asked to use, they will be denied.
I'd really like this to be THE universal security measure. When I install a game, I expect it to tell me that it wants to use the registry (under it's name only), read/write the hard disk (under it's directory and user/saves) and the Network.
If I install word and it tells me it want's to use the network, I expect I'd be able to uncheck that selection and word would function but it would be completely blocked from using the internet at the OS level.
These apps really need to be sandboxed. This generally involves a virtual memory space, but I think Google should be able to pull it off.
In the long run I think Google is headed in the right direction, I'm not sure Apple will be able to keep up in the security arena. Apple is stuck compiling to C which is a little harder to sandbox--Google can manipulate it's code a little better and already has the right idea (if not in the right department yet).
It's not enough for an app to say what things it needs to do. By default any action by a 3rd party app involving personal data or phone calls should explicitly request user permission each and time it is accessed. If the user really trusts an app they could disable these screens from the app's management settings.
This is one of the reasons why I don't mind the Apple App Store process. I'm sure its not perfect, but at least I know Apple has taken a look at apps I run on my phone (although I think they should ask for the source code and have Apple compile it themselves if they want to be really sure).
Regarding App Store approval, I wrote an iPhone app and it took just 1 week for approval.
..if only there was a phone that had a tightly controlled app store that would at least have a chance of catching stuff like this before it gets into the wild. Oh. Wait. There is. Never mind.
Nitewing '98
Everything works...in theory.
If it was black, square, and actually made phone calls I'd buy one just to look badass. Especially if it was only 2x10 serial. Maybe 3x20 or something so it could say 'incoming call from'
Lets see, a simple whois shows:
Administrative Contact Name: Ice Ysl
Administrative Contact Organization: 1sters
Administrative Contact Address1: china
Administrative Contact City: shenzhen
Administrative Contact State/Province: guangdong
Administrative Contact Postal Code: 86
Administrative Contact Country: China
Administrative Contact Country Code: CN
Administrative Contact Phone Number: +7.5526814587
Administrative Contact Email: iceskysl@gmail.com
A google search on iceskysl@gmail.com comes up with a surprising number of hits. No fake email here.
Android Intent is so powerful and great.
Our boy has been busy on the Android
And it goes on...
Was stating that the app is used to render stolen copyrighted material your big chance to try to impress us with a big word?
Just because an application displays pictures doesn't mean it's sole intent is to somehow promote copyright infringement anymore than implying that a camera's sole purpose it to do the same.
These wallpaper apps cannot access your contact's phone numbers, SMS messages or personal information.
Check out the manifest permissions on the apps in question. It is the last item that is the problem.
!Storage
modify Delete
!Your location
coarse (network-based) location
!Network communication
full Internet access
!Phone calls
read phone state and identity
The permission only allow the app to read the IMEI number of your phone (your hardware's unique identifying number), your phone number, and your currently programmed voice-mail number. If you hard coded your voice-mail password as part of your voice-mail number, then they have that too.
They shouldn't be stealing this info, and Google should separate "read phone state" from "read identity", but the stories on this app stating that your SMS's, contacts and grandmother's girdle being stolen and sent to China just plain wrong.
You can get it here - http://www.apple.com/webapps/socialnetworking/facebook.html
Starbucks, Harbuckle of Breath.
Android has really granular security, which is great! Everything from using bluetooth to writing to the sd card has a permission which the developer must explicitly ask for.The problem is that there are *lots* of these permissions, and a user is presented with a list at install time! I installed an IM client the other day (Nimbuzz, which is popular enough and has a good reputation AFAIK), and I don't even remember the 2 screens of permissions which I agreed too.
When presented with "This application has access to the following": ... .....
Your location: coarse (network-based) location
Network communication: full Internet access
Phone calls: Read phone state and identity
System tools: display system-level alerts, modify global system settings, prevent phone from sleeping, retrieve running applications
Uses bluetooth
Writes to your sd card
Changes your volume settings
Executes instruction 0xdeadbeef
Even a geek's eyes glaze over - everybody just clicks ok and hopes for the best.
And to take the Nimbuzz example again, I am quite sure I agreed to authorize permissions which are associated with features I will never use. The fact that there is no way to say "grant this permission but not that one" is a shortcoming which needs to be fixed. There should probably be an "Advanced..." dialog for that, and some system that catches runtime violations and asks if you want to change your settings to allow them or not.
Doubt anyone can pull that off, I have full faith with my left hand.