Slashdot Mirror

← Back to Stories (view on slashdot.org)

Android Data Stealing App Downloaded By Millions

Posted by CmdrTaco on from the nobody-is-safe dept.

wisebabo writes "A wallpaper utility (that presents purloined copyrighted material) 'quietly collects personal information such as SIM card numbers, text messages, subscriber identification, and voicemail passwords. The data is then sent to www.imnet.us, a site that hails from Shenzen, China.'"

7 of 335 comments (clear)

  1. I'm confused... by mcgrew · · Score: 4, Insightful

    A wallpaper APP? Why would you need an app? It can't just display a jpg as wallpaper?

    --
    Free Martian Whores!
  2. Unfortunately by wraithguard01 · · Score: 4, Insightful

    This is one good reason to have a unified app service, where all the apps are first vetted before they are released. I think mozilla's addon collection is a good model to follow.

    1. Re:Unfortunately by AndrewNeo · · Score: 4, Insightful

      Excuse me? I somehow doubt you've ever submitted an addon to Mozilla before. I have, and a real person does indeed check your code.

      From the Editor's Guide:

      Every line of add-on code must be reviewed. The code validator can't detect all possible security or code quality issues, so we must always be in the lookout for bad code.

    2. Re:Unfortunately by diamondsw · · Score: 4, Insightful

      Amazing what a gets a +5 Informative these days. Adding links?

      The first example was due to a developer "hacking" accounts (i.e., guessing passwords).
      The second example is the same story as the first, from a different source.
      The final example is the only one that holds any water. And that allowing crap apps through, not malicious ones.

      --
      I don't know what kind of crack I was on, but I suspect it was decaf.
  3. People will click through anything by Coopjust · · Score: 5, Insightful

    Even if they're told exactly what the app will have access to, people will click through anything.

  4. Re:This is a job for Droidwall by abigor · · Score: 4, Insightful

    You mean they'd have to wait for approval by the App Store? An interesting proposal!

  5. Re:This is a job for Droidwall by mlts · · Score: 4, Insightful

    There is the problem: People like you, me, and almost all Slashdot readers would click "no" if a generic fart app requires a slew of security privs (power, Net, access to SMS, access to contacts, ability to kill other apps, etc.), or even worse, prompted for root privs via su.

    However, the dancing bunny problem strikes here. Joe Sixpack will click "Install" to install a cool app, only to find all his contacts being spammed with "I need $900 ransom" notices, a sky high SMS bill because the app grabs a list of phone numbers and starts sending out text messages with ads on it, maybe even drained bank accounts if he left his banking info and passwords in the Web browser.

    I think Google made one mistake with Android, and that was assuming all users would be clued Linux types who know basic UNIX sanitation. I worry though, if there are more bad apples in the bunch that Android would be start being known as a hive for malware just because there is nothing stopping Joe Sixpack from installing a "pr0n viewer app" that reams his phone.

    I like the walled garden idea, with a way to hop out, that is foreboding to a nontechnical person, but for someone with half a clue, wouldn't pose a problem. For example, the "oem unlock" command with the N1 phones and the warning staying to say buh-bye to the phone's warranty if the user wants to continue. Something to make Joe Sixpack not want to do it and actually pass on watching the dancing bunnies.