Slashdot Mirror
Android Holes Allow Secret Installation of Apps
CheerfulMacFanboy writes with a link to Heise Online which says "'Security researchers have demonstrated two vulnerabilities that allow attackers to install apps on Android and its vendor-specific implementations without a user's permission. During normal installation, users are at least asked to confirm whether an application is to have certain access rights. Bypassing this confirmation request reportedly allows spyware or even diallers to be installed on a smartphone.' One vulnerability was identified when a security specialist analysed HTC devices and found that the integrated web browser has the right to install further packages (used to automatically update its Flash Lite plug-in). Attackers can exploit this if they have found another browser hole. 'Android specialist Jon Oberheide demonstrated another hole which involved misusing the Account Manager to generate an authentication token for the Android Market and obtaining permission to install further apps from there. However, this initially requires a specially crafted app to be installed on the smartphone. Nothing could be easier: Oberheide released the allegedly harmless "Angry Birds Bonus Levels" app into the Android Market and, upon installation, this app downloaded and installed three further apps ("Fake Toll Fraud," "Fake Contact Stealer," and "Fake Location Tracker") without requesting the user's permission.'"
And sits down to watch the fanboy battle begin. Go go go
So that means anyone can compile and install his or her own fixes? So this sounds like a non-issue to me.
A security hole so @#^%&@ adobe can update its garbage flash player every thirty seconds because of security issues.
before they install their apps.
As mentioned before on /., Maybe Google should consider moving to a repository system. By default, Android devices should have a repository where apps are vetted, Apple App Store style. Of course, have the ability for a user to easily turn on the second repository (which would be the current Google App Store) for items not found on the "blessed"/default repo.
This has worked for OSS projects for over a decade. It should work quite well for Android.
See now that Android is becoming a big target = installed base
Old phones are rarely updated.
New phones and evices are still coming out with 1.6
Old 1.6 phones are still alive
All vulnerabilities will persist.
So an auto logging in banking app is there for the taking
There are a lot of upsides to phones that can install aps, browse the web, and so on and so forth. This article is an example of one of the downsides, though. With computer-type capabilities, you get computer type problems. The old wired phones, and probably even most "dumb" cell phones pretty much were only vulnerable to people who had physical access to them altering their behavior. Now phones can theoretically get viruses and dial out on their own and so on and so forth.
I'm not advocating that people discontinue buying smart phones, but it's always good to pause for a second and think about the things we give up to move forward, as it were.
I've been suspicious for a long time that Google is having Microsoft write all their software. This proves it.
If I'm not mistaken, all mobile phones have backdoors for telco's to use, for silently pushing firmware updates and bricking phones, etc.
I might be mistaken, but I'm pretty sure that's what my cousin told me, who works with setting up mobile infrastructure.
Man I found it but Fake Location Tracker doesnt seem to work :(
You must first be in a fake location...duh!
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
They're called "mock locations" on Android. Settings/Applications/Allow mock location.
Shachar
Until smart phone manufacturers realize that they are making general purpose computing devices we will see this. To some there is a "war" going on between Apple and Android but that really misses the issue - in this respect trying to figure out which is the "better" on is like trying to figure out if Frosted Flakes or Fruit Loops is the better breakfast cereal - it is personal preference and there are most likely "better" solutions out there (and as a disclaimer I am an Android user - Droid One).
Until one side truly figures this out I'll stick with Android if for nothing else than I can get the functionality I want. With Apple I have to buy into their idea on how their devices fit into my life and I, well, do not. If Apple truly had this superior model than I would go for it, but as far as I can see I get the worst of both worlds - lack of specialized apps (as those are often, for unknown reasons, rejected from their app store and there are one or two I would like) along with just as many vulnerabilities (and those usually require you store that info on the phone - which until/unless they secure them I do not). So I currently see Apple as having those issues yet none of the "rewards" of going with them.
There are a handfull of people I know I would still recommend the iPhone too, but unless they already know the iPhone platform over the Android and are still asking others about it that is rare. Sadly it isn't because Android is truly better, but because if all else is equal then the flexibility of the Android system is superior and pretty much everything else is equal. Apple has remained where they are for a *long* time because they haven't figured this out too - though I also have to say they have not died because they ignore it too (their model of revenue find this irrelevant, which means they will not "win" but really can not "loose").
------- Sorry about the spelling, I suffer from two problems. Dyslexia makes it difficult to spell well, lazy makes it
Crap like this is why I have data disabled on my phone and install nothing. I'll take the inconvenience of not being able to do other things with my phone for the convenience of not having to fight a ridiculous data or voice charge.
I can understand just wanting a dumb phone, but if that's the case, then why have an android phone in the first place?
I'm sure many Apple devotees will see this news as confirmation that Apple's "we know better than the user" approach is superior.
While I disagree for a number of reasons, for sake of argument, let's assume that they are right. If the walled garden approach is better, won't some enterprising entity create just such a service for Android? The platform is open, anyone can create a market place. Several alternative markets already exist.
There is no reason someone couldn't make a tightly controlled market where apps are scrutinized prior to being offered. If there truly is value in that, I don't see why it wouldn't be done. Such a service could even reject apps for no obvious reason or censor content that doesn't agree with their view of things, if 100% compatibility with that other app store was desired.
-Lod
I'm looking to buy a new phone in a few months. My current Nokia 6300 has lasted for almost 3 years, and is beginning to act a bit weird at times.
I had a look at the Nokia N900 a few days ago and was amazed at the price compared to the specifications and the price point of other smartphones. Qwerty keyboard, 800x480 display, Maemo 5.
Here in Denmark I can buy a new and unlocked for 375 EUR, though I'm tempted to find a used one on eBay -- the price there starts around 200 EUR for a slighty used.
A proud member of the Onion-in-Hand alliance
more features == more security holes less feature == less h4xx0r My next purchase: http://www.johnsphones.com/store/johns-phone-white/item24
If I were rovio software (the makers of angry birds) I would be pretty annoyed that the name of their popular game, and artwork from it, has been used to distribute a malicious program, even if it's just for demonstration purposes.
. So the real question is, will rovio hit the authors with an explosive angry bird or bomb them with an egg-dropping angry bird?
On the plus side, this has reminded me that there is one more level pack I can buy for my n900...
You need a phone with more gee bees and the wifi.
The real issue here is how quickly these are fixed and how easy it is for the end user to get that fix. All major desktop software have done a decent job of making it easier to get the updates, the end user just has to either allow the install or maybe do a click through update. Phones are moving in that direction but some move quicker than other. I hope in time android will be at a point where it will get updates out at a normal pace to end users. I do think that android could learn a few things from ubuntu and other linux distros that have automatic updates. Even vendor supplied roms need to learn something from this process.
I wonder if one can sue a vendor if there is a browser vulnerability that gets fixed in android source but does not make it to their phone?
Only 'flamers' flame!
Does slashdot hate my posts?