Android Holes Allow Secret Installation of Apps

CheerfulMacFanboy writes with a link to Heise Online which says "'Security researchers have demonstrated two vulnerabilities that allow attackers to install apps on Android and its vendor-specific implementations without a user's permission. During normal installation, users are at least asked to confirm whether an application is to have certain access rights. Bypassing this confirmation request reportedly allows spyware or even diallers to be installed on a smartphone.' One vulnerability was identified when a security specialist analysed HTC devices and found that the integrated web browser has the right to install further packages (used to automatically update its Flash Lite plug-in). Attackers can exploit this if they have found another browser hole. 'Android specialist Jon Oberheide demonstrated another hole which involved misusing the Account Manager to generate an authentication token for the Android Market and obtaining permission to install further apps from there. However, this initially requires a specially crafted app to be installed on the smartphone. Nothing could be easier: Oberheide released the allegedly harmless "Angry Birds Bonus Levels" app into the Android Market and, upon installation, this app downloaded and installed three further apps ("Fake Toll Fraud," "Fake Contact Stealer," and "Fake Location Tracker") without requesting the user's permission.'"

Comments

Re:Makes popcorn

[Anonymous Coward]

Not an issue with iOS. It is 100% secure from this type of hacks. People who value their security go with the mature platforms and apps that have been checked over by professionals to make sure they are not Trojans.

I can't find that app in the App Store

[Brannon]

I click on the little App Store icon (the one that always has a red circle with some number in it) and then put in "Angry Birds Bonus Levels" on the search thingy and it doesn't find it.

Who do I call to complain about that, iTunes or Apple?

What is Android? is that a new game for iphones?

It's a Feature

[fermion]

Going back to a logic of a company we all know, this is clearly a feature. We clearly need to be to be able to install updates automatically. Once the App is installed, the user has already given permission to have the App on the device. What is the point of wasted the users time to confirm updates. Won't users be happy to have additional functionality. Isn't this the benefit of the Android open garden? Not to have to deal with all that bureaucracy that keeps the best Apps off more closed platforms, such as companies that want to trade minimal content for access to a user full browsing history, contact list, installed Apps, and locations list?

So there's a different store?

[Brannon]

How do I point my iphone at the Google store? isn't Google in safari? I really want to try the angry birds bonus level.

Re:Time to move to a repository system?

[chickenarise]

I dunno if you're trolling, but I'll bite... ASS, whole lotta ASS all up in your cunt. Fuckin up all that shit and cuntfuckin yourself fist first in the ass. YOUR SHIT IS IN YOUR ASS COMING OUT OF YOUR CUNT! Lol your shitass is cuntwiping all over the place, you shitty assfucker. What in the fuck is with your cuntface asslicker dickfucker brainstem? Is that why all the shit is coming from your cunt?