Slashdot Mirror
Android Holes Allow Secret Installation of Apps
CheerfulMacFanboy writes with a link to Heise Online which says "'Security researchers have demonstrated two vulnerabilities that allow attackers to install apps on Android and its vendor-specific implementations without a user's permission. During normal installation, users are at least asked to confirm whether an application is to have certain access rights. Bypassing this confirmation request reportedly allows spyware or even diallers to be installed on a smartphone.' One vulnerability was identified when a security specialist analysed HTC devices and found that the integrated web browser has the right to install further packages (used to automatically update its Flash Lite plug-in). Attackers can exploit this if they have found another browser hole. 'Android specialist Jon Oberheide demonstrated another hole which involved misusing the Account Manager to generate an authentication token for the Android Market and obtaining permission to install further apps from there. However, this initially requires a specially crafted app to be installed on the smartphone. Nothing could be easier: Oberheide released the allegedly harmless "Angry Birds Bonus Levels" app into the Android Market and, upon installation, this app downloaded and installed three further apps ("Fake Toll Fraud," "Fake Contact Stealer," and "Fake Location Tracker") without requesting the user's permission.'"
And sits down to watch the fanboy battle begin. Go go go
So that means anyone can compile and install his or her own fixes? So this sounds like a non-issue to me.
Man I found it but Fake Location Tracker doesnt seem to work :(
A security hole so @#^%&@ adobe can update its garbage flash player every thirty seconds because of security issues.
before they install their apps.
As mentioned before on /., Maybe Google should consider moving to a repository system. By default, Android devices should have a repository where apps are vetted, Apple App Store style. Of course, have the ability for a user to easily turn on the second repository (which would be the current Google App Store) for items not found on the "blessed"/default repo.
This has worked for OSS projects for over a decade. It should work quite well for Android.
See now that Android is becoming a big target = installed base
Old phones are rarely updated.
New phones and evices are still coming out with 1.6
Old 1.6 phones are still alive
All vulnerabilities will persist.
So an auto logging in banking app is there for the taking
How do I point my iphone at the Google store? isn't Google in safari? I really want to try the angry birds bonus level.
Not any more...
Surrender and go Amish!
There are a lot of upsides to phones that can install aps, browse the web, and so on and so forth. This article is an example of one of the downsides, though. With computer-type capabilities, you get computer type problems. The old wired phones, and probably even most "dumb" cell phones pretty much were only vulnerable to people who had physical access to them altering their behavior. Now phones can theoretically get viruses and dial out on their own and so on and so forth.
I'm not advocating that people discontinue buying smart phones, but it's always good to pause for a second and think about the things we give up to move forward, as it were.
I've been suspicious for a long time that Google is having Microsoft write all their software. This proves it.
If I'm not mistaken, all mobile phones have backdoors for telco's to use, for silently pushing firmware updates and bricking phones, etc.
I might be mistaken, but I'm pretty sure that's what my cousin told me, who works with setting up mobile infrastructure.
a few month ago there was a vulnerability that left your data wide open with or without a pin on the iphone. Or the fake iphone security update that basically takes over your iphone (http://bit.ly/afwVEu). If you allow programs that aren't made by the apple or google you will always have this problem. Program A needs access to do this, you give it access, now anything in program A that was put there has that access too. Oh new iphone safari browser hole (http://www.epagini.com/2010/08/iphone-vulnerability-detected/). Neither phone is the standard for security, no one is. LOL, now give me a phone running openvms, no it probably wouldn't be any secure, I just want to see someone get it to run on a phone.
Crap like this is why I have data disabled on my phone and install nothing. I'll take the inconvenience of not being able to do other things with my phone for the convenience of not having to fight a ridiculous data or voice charge.
Man I found it but Fake Location Tracker doesnt seem to work :(
You must first be in a fake location...duh!
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
They're called "mock locations" on Android. Settings/Applications/Allow mock location.
Shachar
Until smart phone manufacturers realize that they are making general purpose computing devices we will see this. To some there is a "war" going on between Apple and Android but that really misses the issue - in this respect trying to figure out which is the "better" on is like trying to figure out if Frosted Flakes or Fruit Loops is the better breakfast cereal - it is personal preference and there are most likely "better" solutions out there (and as a disclaimer I am an Android user - Droid One).
Until one side truly figures this out I'll stick with Android if for nothing else than I can get the functionality I want. With Apple I have to buy into their idea on how their devices fit into my life and I, well, do not. If Apple truly had this superior model than I would go for it, but as far as I can see I get the worst of both worlds - lack of specialized apps (as those are often, for unknown reasons, rejected from their app store and there are one or two I would like) along with just as many vulnerabilities (and those usually require you store that info on the phone - which until/unless they secure them I do not). So I currently see Apple as having those issues yet none of the "rewards" of going with them.
There are a handfull of people I know I would still recommend the iPhone too, but unless they already know the iPhone platform over the Android and are still asking others about it that is rare. Sadly it isn't because Android is truly better, but because if all else is equal then the flexibility of the Android system is superior and pretty much everything else is equal. Apple has remained where they are for a *long* time because they haven't figured this out too - though I also have to say they have not died because they ignore it too (their model of revenue find this irrelevant, which means they will not "win" but really can not "loose").
------- Sorry about the spelling, I suffer from two problems. Dyslexia makes it difficult to spell well, lazy makes it
There will always be A-holes.
Apparently Google chose the name Android appropriately... It sounds intelligent, it looks intelligent, but there's something fishy going on behind those pretty vacant holes in its head.
Of course this entire thread is based on the notion that there is any implied 'security' in an industry that is dominated by the concern for turning personal computing devices into marketing platforms capable of tracking the every move of their owners...
If the general public had any brains they'd stop buying PC's and Smart Phones for an entire quarter and then start demanding that technology companies bid for the privilege of equipping them with the myriad of tracking devices and technologies currently used to scrutinize their every behavior.
At least we can all feel secure in the knowledge that our Intelligence agencies can utilize these security 'holes' to track crime as well as record calls, texts and movements of anyone they feel might possibly perpetrate a crime.
This sounds like a similar backdoor to what apple use to BRICK phones because JOBS doesn't approve of what they are doing with them. Or the same control freak doesn't approve of the software, or because the one and only can't over charge for security updates etc etc etc.
At least with Android you still CAN install programs and update what the legal owner wants on the device that they have bought. In reality has proven more secure than OTHER systems.
Yes it could be vulnerable if the end user is not sensible, but at least the end user has a choice, and not at the hands of a dictator type company.
And low and behold there is a fix and OPEN information for the end user to know. Not a closed controlled system with no info, and definitely no choice!
Backdoors will forever be part of the computer system, as is with OSX, iPhone and Windows, but at least an open system is available for scrutiny.
I'm sure many Apple devotees will see this news as confirmation that Apple's "we know better than the user" approach is superior.
While I disagree for a number of reasons, for sake of argument, let's assume that they are right. If the walled garden approach is better, won't some enterprising entity create just such a service for Android? The platform is open, anyone can create a market place. Several alternative markets already exist.
There is no reason someone couldn't make a tightly controlled market where apps are scrutinized prior to being offered. If there truly is value in that, I don't see why it wouldn't be done. Such a service could even reject apps for no obvious reason or censor content that doesn't agree with their view of things, if 100% compatibility with that other app store was desired.
-Lod
Kinda offtopic but this still seems like a good place to ask.
I'm thinking of buying HTC Desire (with Android 2.2), which would be my first real smartphone (My previous Samsung from a few years back was probably a borderline case). HTC Desire seems like a good option because I don't like Apple (thus: No iPhones), don't really trust Windows on a phone (not entirely rejecting that option but... yeah), I keep hearing that Symbian phones are behind the curve and it is my understanding that Android 2.2 is far faster than 2.1.
The thing is... That it costs a lot. 484,90 euros (=664 dollars [Yeah, we have 23% VAT, which means that prices are pretty high]) isn't a complete non-issue in my budget so while I would be willing to pay that for a really good phone, I don't want to pay that and be disappointed. And I've read some negative things about Android, too (Poor keyboard, poor UI...). I live in a country where we buy phones and phone contracts separately, so some provider specific lock ins aren't an issue for me. (Obviously, any restrictions by HTC still are)
If someone with more experience about Android (preferrably 2.2 but also Android in general) and perhaps about smartphones in general would like to give their opinions on whether buying HTC Desire with Android 2.2 is a good idea or not... I'd appreciate that.
Forgot to say that the things I'd probably use it mostly for browsing the internet, tethering/wifi hotspot, GPS ("I've never used this bus before... I wonder how close my stop is..."), e-mail (though this could go under "browsing" as I could just use webmail) and of course for calling and text messaging.
Parent is not a troll but "ordinary user", it is exactly the response you would get from an ordinary user.
more features == more security holes less feature == less h4xx0r My next purchase: http://www.johnsphones.com/store/johns-phone-white/item24
If I were rovio software (the makers of angry birds) I would be pretty annoyed that the name of their popular game, and artwork from it, has been used to distribute a malicious program, even if it's just for demonstration purposes.
. So the real question is, will rovio hit the authors with an explosive angry bird or bomb them with an egg-dropping angry bird?
On the plus side, this has reminded me that there is one more level pack I can buy for my n900...
You need a phone with more gee bees and the wifi.
http://developers.slashdot.org/comments.pl?sid=1865828&cid=34208648 instead of doing hit & run "moddowns" via your alternate registered user accounts? After all: A mod down isn't worth anything if you can't backup the reasons for which it was given, and with solid facts.
What, and eliminate Android's openness? That's heresy, I say.
Schmidt, call in the guards!
Wait wait wait... You can compromise a system by installing harmful software from untrusted sources?!
This is revolutionary news!
The real issue here is how quickly these are fixed and how easy it is for the end user to get that fix. All major desktop software have done a decent job of making it easier to get the updates, the end user just has to either allow the install or maybe do a click through update. Phones are moving in that direction but some move quicker than other. I hope in time android will be at a point where it will get updates out at a normal pace to end users. I do think that android could learn a few things from ubuntu and other linux distros that have automatic updates. Even vendor supplied roms need to learn something from this process.
I wonder if one can sue a vendor if there is a browser vulnerability that gets fixed in android source but does not make it to their phone?
Only 'flamers' flame!
Does slashdot hate my posts?