Slashdot Mirror
'Fee-Deduction' Malware On Android Spotted In the Wild
wiredmikey writes "New malware has been discovered embedded in more than 20 Android applications circulating via various forums on the Internet which auto-dials phone numbers to incur high user fees. Dubbed BaseBridge, the malware can be embedded in legitimate applications, and during the application's installation, the malware prompts the user to upgrade. If the user chooses to upgrade, the malware is installed on the Android device under the name 'com.android.battery'. Then, another prompt would pop up to ask the user to restart the app to run it, and the malware is formally activated upon restart. Once activated, the malware can activate three malicious services — AdSmsService, BridgeProvider and PhoneService, to communicate with a control server, from which it will download a configuration file to read related information and dial calls or send out SMS messages, incurring fees for users."
Malware only affects stupid lusers on Wiblows and OSuX, not linux!!!!
That is the treat of sideloading. And I wouldn't give it up for anything.
I am confused of who determines what is a 'cyber attack'. To me this sounds like one
Say what you will about Apple's "walled garden", but I'm kinda happy I'm inside it. That's not to say that iOS is not exploitable because it most certainly is, but it's much less likely something I purchase off the app store will contain malware like this.
Wow. I'm sure glad I stuck with Microsoft Windows CE Mobile Phone 7 Series SP1 Smartphone Edition Build 2943 codenamed {some vacation spot}, with Microsoft's great familiar track record for security and all...
It would be nice to see a list of the Apps. If there are "over 20" the list is probably not too large to post.
Flexible bare-metal recovery for Linux/UNIX
Plain and simple.
Is it just to annoy people? What benefit do the authors receive from getting the phone to make random calls or send SMS?
Proof of concept, perhaps?
That is the treat of sideloading. And I wouldn't give it up for anything.
So you would doom millions to be raked over the coals by exploits like this, all so you can sideload. Awesome.
Shouldn't the model be more of one where people who cannot manage systems have systems pre-secured for them, and the ones who can handle security can open them?
It's worked well for iOS from a security standpoint.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
...though not publicly, about the chaos in Android's ecosystem. Seems that everything he predicted is coming to pass.
Folks, we need sanity on Android. Currently, it's nowhere to be seen. Who can deny that?
I kept hearing that Linux was immune to malware all these years here, and yet I am seeing a Linux variant in ANDROID showing holes and malware attacks left and right the past few years now.
(Has slashdot's Penguin crowd been lying to us all for all these years now? Seems so.)
Go back to your bridge.
Trojans in software downloaded from sketchy websites? GTFO!
See subject
A user with root explicitly installing a program IS NOT A HOLE.
Good-bye
The iPhone has similar issues. JB the iPhone, grab pirated apps from unknown/untrusted repos, shovel them via Installous, and there have been some really nasty things reported.
The average user is not going to be sideloading apps, and if told to by a website, he or she should be VERY wary, and be checking search engines about the app mentioned.
He was asking about Linux being said to be immune from malware for years here on slashdot. That's being shown as a lie by ANDROID itself, a Linux variant, turning up malware left and right for the past few years. No more hiding behind the thin mask of "security-by-obscurity" anymore, is there, Penguins? The truth's out, and your Operating System's based on lies of saying Linux is immune to malware. Same crap from the MacOS X camp around here also. MacDefender's showing us all that MacOS X too can be taken down by malware, despite all the lies and utter bullshit that slashdot nix trolls spouted here for years. Too bad the truth's out, eh boys?
In addition you must know what you're doing to install the Unknown Source APK by either: using 'adb install', or downloading the APK to your SD card and use a file manager application
That or enter the URL from which the APK can be downloaded, such as through following a link in an e-mail, following a link in the web browser, or scanning a QR code. After that, the device downloads the package over Wi-Fi or cellular, and then the user can choose to install or cancel on the privilege screen. That's how, for example, Amazon Appstore for Android gets installed.
No operating system can protect stupid users from installing dubious applications.
Regardless how many security walls you put in place, if the user says yes to everything there is no way he will get protected.
The stupid thing is that this then lands in the stupid non-technical press as "platform X has malware" articles.
Nice try, but you still couldn't resist randomly bolding shit. Honestly, these days I think 10 year old girls do a better job with their makeup than you do with your markup. Replying to other people and screaming at them to answer "his" (your) question is just the confirmation exercise.
Nobody ever claimed that Linux was immune to people installing shit on it. Hell, nobody ever claimed it was immune to :(){:|:&};: You are the only one who seems to believe that when people say nobody makes viruses for Linux that all of a sudden that means they're claiming that no malware at all can possibly exist.
cool story bro....
No app list, no advisories, no way to gain *any* information...unless you download their product and run it to find out....you're not infected.
How quaint.
I'm shocked these guys don't have a rogue anti-malware scam going. They are only one step away now, so...look for it "Real Soon Now"!
I love apps on my phone, but along the way, I have to wonder, just how smart is this? My phone is for me, as for many, my primary communications device. I get loading an IM app or an invoicing app or even some Angry Birds. There comes an implicit trust there, I suppose.
I'm cool with tinkering.. that's how our modern marvels came to be. However, tinkering comes with implicit risk. The problem is people tinker and expect the mission critical stuff (like your phone making calls everytime you want, and only when you want) to still remain iron-clad.
It's like jacking with beta software. Yeah, do it on your local machine. However, if you do it on your production server, and you lose data or have run-away costs, that's just too bad.
The best thing about a boolean is even if you are wrong, you are only off by a bit.
there have been some really nasty things reported.
References? While there's certainly the potential for such abuses, I haven't heard of anything in the wild to date.
https://www.eff.org/https-everywhere
To malware like has been implied here over time, and how Apple said they were basically on T.V. Commercials no less? Well, well, will wonders never cease! I kept hearing how Linux is immune to malwares over time here and now that time has passed, it appears that was a line of the purest bullshit.
At least Android has "Unknown sources" and "adb install" in the first place. Amazon appears to have convinced AT&T to push a firmware update that restores the checkbox, and "adb install" sideloading support is a requirement for Market access. In addition, devices without the Android Market application, such as such as all Archos products, ship with "Unknown sources" turned on so that the bundled AppsLib can work.
Same with MacOS X and Apple, eh?? LMAO! Despite all the slashdot "FUD" and Apple T.V. Commercials saying that nix variant Operating Systems can't be infested appears to have been the hugest line of bullshit ever perpetrated upon unsuspecting users. Linux's security model seems to be FAILING on ANDROID phones (so much for hiding behind literally NO MARKET SHARE on PC's, and "security-by-obscurity" eh, Penguin FUD spreading trolls... lmao!)
LMAO - The "best security model" NIX users have on /. is to downmod anything that shows NIX for what it really is - based on lies!
(Downward moderations, simply to hide the truth of things via mod downs from most users since slashdot sets the mark for most browsers to be above 0 or more)
?
Please: Make us laugh some more at your falsehoods over the past nearly 2 decades being shown for what they are: LIES!
Yes, yes, we know - hide posts that ask honest questions based on facts (like a NIX variant in ANDROID being malware ridden as well as MacOS X being hit by numerous variants of MacDefender lately and other malware in the past)?
LMAO! Keep perpetrating your lies Penguins, and keep going downwards into oblivion!
So first you have to ignore the "HEY, YOU'RE INSTALLING OFF THE MARKET. ANYTHING THAT DAMAGES THE PHONE OR THE DATA ON YOUR PHONE IS OF YOUR OWN RISK" and click yes to the Unknown Sources dialog. Then you have to click the Install button on the screen that says "SERVICES THAT COST YOU MONEY: MAKING CALLS, SENDING SMS".
You wouldn't let a random stranger into your house, why would you let a random application into your device -- especially since this stranger's announced that they'll be making phone calls and sending text messages?
If one visits sites like MacRumors, and looks under the iPhone hacks section, you will find a good amount of people posting about installing apps with Installous from dodgy repos. They all kinds of problems, from having to DFU restore, to corruption of other app's data, and so on.
The evidence is anecdotal (someone whining about a spotty JB iPhone that has been heavily modified could be a lot of issues), but slapping on pirated apps from repos that have not been vetted is just asking for an additional payload to come with the .apk file.
Friend, I work as a Linux/UNIX security consultant and if I thought you had enough knowledge about Linux/UNIX to understand an explanation I could give you about how a UNIX-like OS differs from, say, Windows in terms of threat attack vectors, then I would do so. But because I doubt your IQ barely reaches 3-digits in length, such an explanation would be wasted on you.
Suffice it to say, I do not recall anyone on here ever saying that Linux is immune to malware because, the fact is, any program you run on any OS anywhere that you cannot guarantee is malware-free could be malware - so clearly anyone making such a statement would be a bigger fool than yourself.
But you can satisfy yourself in the knowledge that, by virtue of the well-paid job that I do, that there are security considerations you must take into account when deploying any Linux or UNIX server - beyond that, you need not worry yourself as clearly your lack of knowledge shows you don't use Linux in any shape or form. Therefore how secure or insecure it is would be irrelevant within your small and blinkered view of reality.
Gentoo Linux - another day, another USE flag.
I am not sure 100% that this is the answer but I think it is high time that we use digital signatures to verify the authenticity of the code. In the open source community this is done all of the time with utilities like GNUPG. Just simply use the author's public key to verify the authenticity of the code. If there is a discrepancy, then there should be a provision to discard the downloaded app. That should, at least, put a severe curb on wrapping malware in legitimate applications.
which may void your warranty (on the hardware, not just the OS)
You simply restore to factory OS before taking it in for hardware support.
Because if you jailbreak you have a clue. Remember?
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Linux is just the kernel, the small but complex piece of software that sits between the user's operating system and the system hardware. It's function is to ready the hardware for use by the operating system, so is responsible for loading drivers and setting up parameters specific to the CPU it is running on.
Anything else beyond that is the operating system that gets loaded once the kernel is in place. For convenience, the whole thing is referred to as "Linux" but, in reality, it is just a myriad of programs doing various tasks on that piece of hardware.
Bearing in mind that the OS tools running on top of the kernel are Open Source, there are no "rules" as to how you design that system to run once the kernel has loaded. Therefore, if you want to design an OS schema whereby everything runs at the highest root permissions, there is nothing stopping you doing that.
Having explained the above to you, I have permitted you to divest yourself of your clear ignorance when it comes to how Linux and free operating systems work.
With the above in mind, Android does indeed use a Linux kernel to initialise the hardware in a smartphone, touchpad, netbook, etc. etc. However, beyond that there are numerous reasons why an Android system would boot into the OS very differently to, say, a Ubuntu or Fedora Linux desktop - one of the major diffences would be because storage space and memory are far more limited on a smartphone or tablet than on an average desktop PC.
Consequently, your comparison between Android and Linux is invalid - if anything, a piece of malware running on an Android system probably wouldn't run on a Ubuntu system if it was transferred across, or indeed vice versa.
Any computer system needs to be hardened against security threats but your comments clearly show that you possess little knowledge of the subject - therefore you would be better employed spending your free time becoming better-informed on the subject first, and then coming on here to make what could be some very valid points about Linux security.
This would be a constructive alternative to just spewing out random comments and appearing like a complete and utter plonker.
Gentoo Linux - another day, another USE flag.
Or, we could treat the real problem, personal idiocy, and educate people.
Bullshit. It's not idiocy, it's lack of understanding. And the truth is that you cannot educate people on something they have no interest in. Nor should there be a need for education, I don't have to be a structural engineer to drive over a bridge, because I know the people who made it are competent. The same should be true of OS's we use, the makers should have secured that for us as much as possible to the point where normal users do not need any understanding or education to keep the device safe for use.
Your response is every bit as absurd as "you're holding it wrong".
"There is more worth loving than we have strength to love." - Brian Jay Stanley
LMAO - ok "big man" (big f'ing deal, security consultant... do YOU really *THINK* that 'impresses me', boy?): Let's use some statistics then - time to make YOU, look VERY stupid (and you assume you're talking to someone that knows NOTHING about securing OS' either (dumb)):
"I work as a Linux/UNIX security consultant" - by pandrijeczko (588093) on Tuesday May 31, @03:20PM (#36300482)
This is supposed to "impress me", right boy? Take a peek @ my p.s. below, & don't assume you're talking to some NOOB, boy... ok??
---
"and if I thought you had enough knowledge about Linux/UNIX to understand an explanation I could give you about how a UNIX-like OS differs from, say, Windows in terms of threat attack vectors, then I would do so." - by pandrijeczko (588093) on Tuesday May 31, @03:20PM (#36300482)
Oh, really? Ok then - take a peek here:
http://mobile.slashdot.org/comments.pl?sid=2200490&cid=36300084
Seems the LINUX KERNEL 2.6x ALONE has 3.5++ times as many unpatched security holes as does nearly THE ENTIRE GAMUT/ARRAY of what Microsoft gives users to do business & development with...
Can you say the same of say, MySQL, Apache, & all the other analogs to what that link/url has in it above? I doubt it. You toss those things onto Linux?? Inclusive of what just comes in the distro package ALONE, that 3.5x times the # of unpatched bugs in Linux would go "up, Up, UP & AWAY"...
LOL! So much for your "b.s." boy (you're probably MANY years my junior & 1/100th as accomplished in this field as I am over time (the list below is VERY small & only partial too mind you - I could put out FAR more!)
---
"But you can satisfy yourself in the knowledge that, by virtue of the well-paid job that I do, that there are security considerations you must take into account when deploying any Linux or UNIX server - beyond that, you need not worry yourself as clearly your lack of knowledge shows you don't use Linux in any shape or form." - by pandrijeczko (588093) on Tuesday May 31, @03:20PM (#36300482)
LMAO - you poor little deluded fool: Do you *THINK* you're the "only person that setup Linux for business"? Do you?? Guess again, fool. I've done it 100's of times, & the principals are generically, rather the SAME in general, for layered security setups in Linux, MacOS X, or Windows really!
"Therefore how secure or insecure it is would be irrelevant within your small and blinkered view of reality." - by pandrijeczko (588093) on Tuesday May 31, @03:20PM (#36300482)
Ahem: ALL thru your 'reply' here boy, all you do is toss names & other snide innuendo... is that "the best you've got" BOY?
(Apparently so!)
---
"But because I doubt your IQ barely reaches 3-digits in length, such an explanation would be wasted on you." - by pandrijeczko (588093) on Tuesday May 31, @03:20PM (#36300482)
What a fool... I mean, for example, are YOU the "only person" that's tightened a MySQL DB, or Apache (LAMP system in general)? Are YOU the "only person" that's used SeLinux (which isn't setup NEARLY as tightly secured by default as it can be)??
Please... give us a break - I've done that, in addition to 100's of Windows setups over time too. You're arrogant, and you assume too much (and it does appear that the best you have, is adhominem attacks)
---
"Suffice it to say, I do not recall anyone on here ever saying that Linux is immune to malware because, the fact is, any program you run on any OS anywhere that you cannot guarantee is malware-free could be malware - so clearly anyone making such a statement would be a bigger fool than yourself." - by pandrijeczko (588093) on Tuesday May 31, @03:20PM (#36300482)
OH ma
Excellent.
You are improving. You have mastered "Cut & Paste" keys, well done! :-)
Now go read a few security manuals, get a few years experience in OSes and security, then you can set your sights on one day being able to speak to me at the same intellectual level. Hell, I may even reach down and help pull you up those last few steps of your very tiring climb.
Gentoo Linux - another day, another USE flag.
Linux kernel 2.6x, vs. NOT just the OS either in Windows 7, but rather nearly the ENTIRE GAMUT of what comes from Microsoft has LESS KNOWN SECURITY ISSUES UNPATCHED than does the LINUX KERNEL!
(That's FACT! See below... & "eat your arrogant words" boy, now flavored with "the bitter taste of YOUR defeat", lol!)
Linux 2.6x kernel too ONLY mind you, NOT THE REST OF WHAT COMES IN THE DISTRO like Window managers, GUI shells, apps etc. which HUGELY COMPOUNDS it even more, and worse still, for Linux:
To wit/e.g.:
---
Vulnerability Report: Microsoft SQL Server 2008: (05/31/2011)
http://secunia.com/advisories/product/21744/
Unpatched 0% (0 of 0 Secunia advisories)
Vulnerability Report: Microsoft Internet Information Services (IIS) 7.x: (05/31/2011)
http://secunia.com/advisories/product/17543/
Unpatched 0% (0 of 6 Secunia advisories)
Vulnerability Report: Microsoft Exchange Server 2010: (05/31/2011)
http://secunia.com/advisories/product/28234/
Unpatched 0% (0 of 0 Secunia advisories)
Vulnerability Report: Microsoft SharePoint Server 2010: (05/31/2011)
http://secunia.com/advisories/product/29809/
Unpatched 0% (0 of 0 Secunia advisories)
Vulnerability Report: Microsoft Forefront Endpoint Protection 2010: (05/31/2011)
http://secunia.com/advisories/product/34343/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Office 2010: (05/31/2011)
http://secunia.com/advisories/product/30529/?task=advisories
Unpatched 0% (0 of 6 Secunia advisories)
Vulnerability Report: Microsoft Virtual PC 2007: (05/31/2011)
http://secunia.com/advisories/product/14315/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Internet Explorer 9.x: (05/31/2011)
http://secunia.com/advisories/product/34591/
Unpatched 0% (0 of 0 Secunia advisories)
Vulnerability Report: Microsoft Visual Studio 2010: (05/31/2011)
http://secunia.com/advisories/product/30853/?task=advisories
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft DirectX 10.x:
(05/31/2011)
http://secunia.com/advisories/product/16896/
Unpatched 0% (0 of 3 Secunia advisories)
Vulnerability Report: Microsoft .NET Framework 4.x:
(05/31/2011)
http://secunia.com/advisories/product/29592/
Unpatched 0% (0 of 3 Secunia advisories)
Vulnerability Report: Microsoft Silverlight 4.x: (05/31/2011)
http://secunia.com/advisories/product/28947/
Unpatched 0% (0 of 0 Secunia advisories)
Vulnerability Report: Microsoft XML Core Services (MSXML) 6.x: (05/31/2011)
http://secunia.com/advisories/product/6473/
Unpatched 0% (0 of 4 Secunia advisories)
Vulnerability Report: Microsoft Windows 7: (05/31/2011)
http://secunia.com/advisories/product/27467/?task=advisories
Unpatched 8% (5 of 65 Secunia advisories)
This is ultimately no different from the days of downloading trojan-laden warez from a BBS or pr0n site and getting infected with an autodialer that calls some random long-distance number through the modem.
If you're not willing to be careful about what you're installing, or where you're downloading it from, don't be surprised when your phone racks up random charges without your direct input.
Someday, you're going to die. Get over it.
In terms of overall experience at ALL levels (Operating System security, programming & analysis, degrees & more? Boy, you're a NOOB compared to me... show me 1/10th of what I've done to YOUR credit, & before I did them especially then... ok? You can't and YOU KNOW IT!).
I've been at these things since 1982 little boy, and at ALL LEVELS noted above... how about you?
"Now go read a few security manuals, get a few years experience in OSes and security, then you can set your sights on one day being able to speak to me at the same intellectual level. Hell, I may even reach down and help pull you up those last few steps of your very tiring climb." - by pandrijeczko (588093) on Tuesday May 31, @03:52PM (#36300818)
You're a "BIG TALKER" & that's about it! I've done the "security consultant" bit for both camps (NIX & Windows) & know EXACTLY what I'm talking about!
In fact, so much so, that the guide I've written up for Windows security is the:
You MAY wish to refer to the link below that shows a security guide I did for Windows (from 1997-current) as it is:
http://www.neowin.net/news/apk-a-to-z-internet-speedup--security-text
AND, more currently, the MOST viewed & highly rated one there is for years now since 2008 online:
http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE
Which has well over 300,000++ views online (actually MORE, but 1 site with 75,000 views of it went offline/out-of-business) & it's been made either:
---
1.) An Essential Guide
2.) 5-5 star rated
3.) A "sticky-pinned" thread
4.) Most viewed in the category it's in (usually security)
5.) 2.) Got me PAID by winning a contest @ PCPitStop (quite unexpectedly - I was only posting it for the good of all, & yes, "the Lord works in mysterious ways", it even got me PAID -> http://techtalk.pcpitstop.com/2007/09/04/pc-pitstop-winners/ (see January 2008))
---
Across 15-20 or so sites I posted it on back in 2008...
IMPORTANT:
So - Have YOU done better, troll? We want something we can SEE, not just your "alleged status" as a "security consultant", ok??
No, obviously.
(So much for your attempts @ "discrediting me" with "std. troll disinformation protocol", because it falls apart in the light of FACTS... easily! Just "too, Too, TOO EASILY" in fact!)...
However, since we're on the subject of security, Linux vs. Windows? Ok... how about I "up the ante" & show nearly ALL of what MS makes for business & development, vs. the Linux kernel ALONE then?
Here we go:
Linux kernel 2.6x, vs. NOT just the OS either in Windows 7, but rather nearly the ENTIRE GAMUT of what comes from Microsoft has LESS KNOWN SECURITY ISSUES UNPATCHED than does the LINUX KERNEL!
(That's FACT! See below... & "eat your arrogant words" boy, now flavored with "the bitter taste of YOUR defeat", lol!)
Linux 2.6x kernel too ONLY mind you, NOT THE REST OF WHAT COMES IN THE DISTRO like Window managers, GUI shells, apps etc. which HUGELY COMPOUNDS it even more, and worse still, for Linux:
To wit/e.g.:
---
Vulnerability Report: Microsoft SQL Server 2008: (05/31/2011)
http://secunia.com/advisories/product/21744/
Unpatched 0% (0 of 0 Secunia advisories)
Vulnerability Report: Microsoft Internet Information Services (IIS) 7.x: (05/31/2011)
http://secunia.com/advisories/product/17543/
Unpatched 0% (0 of 6 Secunia advisories)
Vulnerability Report: Microsoft Exchange Server 2010:
Despite all your "big talk" & trying to put me down, you haven't been even a FRACTION of as well noted in the art & sciences of computing as I have... and, you're "trying to tell me how it works"? Please - what year were you BORN in?? I must ask, because I've been at most ALL forms of computer operating systems (inclusive of midrange & mainframe OS stuff on IBM "big iron" thru the System 34/36/38-OS/400-zOS series), & since 1982.
I'd wager thus, just on a guess? I've been at these things LONGER THAN YOU HAVE BEEN ALIVE, & done fairly well @ it too in the eyes of others as well as being professionally paid for it & on MANY levels inclusive of security, programming/analysis + system architecture & design, as well as mgt. too!
Give me a break - get over yourself, BOY... you act as if you're the "only knowledgeable person around" & you? You're FAR from that... hell:
You can't even SHOW US A DAMNED THING YOU'VE EVER DONE THAT WAS NOTED AS GOOD BY OTHERS IN PUBLICATION (trade mags, books, newspapers etc.), COMMERCIAL SOFTWARE, OR TRADE SHOWS et al as I have!
APK
P.S.=> Lastly: I find it FUNNY how the statistics of the Linux kernel alone having more unpatched security vulnerabilities than does nearly ALL of what Microsoft offers to do business & development with "shut you up", & fast... lol, you arrogant little boy! apk
Despite all your "big talk" & trying to put me down, you haven't been even a FRACTION of as well noted in the art & sciences of computing as I have... and, you're "trying to tell me how it works"?
Please - what year were you BORN in??
I must ask, because I've been at most ALL forms of computer operating systems (inclusive of midrange & mainframe OS stuff on IBM "big iron" thru the System 34/36/38-OS/400-zOS series), & since 1982.
I'd wager thus, just on a guess?
I've been at these things LONGER THAN YOU HAVE BEEN ALIVE, & done fairly well @ it too in the eyes of others as well as being professionally paid for it & on MANY levels inclusive of security, programming/analysis + system architecture & design, as well as mgt. too!
Give me a break - get over yourself, BOY... you act as if you're the "only knowledgeable person around" & you? You're FAR from that... hell:
You can't even SHOW US A DAMNED THING YOU'VE EVER DONE THAT WAS NOTED AS GOOD BY OTHERS IN PUBLICATION (trade mags, books, newspapers etc.), COMMERCIAL SOFTWARE, OR TRADE SHOWS et al as I have... despite all your "alleged greatness" & trying to "put me down"!
(Come back when you've actually DONE something that others noted as decent, ok?)
APK
P.S.=> Lastly: I find it FUNNY how the statistics of the Linux kernel alone having more unpatched security vulnerabilities than does nearly ALL of what Microsoft offers to do business & development with "shut you up", & fast... lol, you arrogant little boy! apk
Right, we need to check mental sanity of people that activate the option to install software from outside the market
As they are explicitly told to do by Amazon?
It's a design feature of the platform than any mainstream alternate application stores must have you disable this block, and then any random link can install something for you. Do you really not expect a significant number of users will be getting things from Amazon given the marketing clout they have?
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Funny how you're not trying to "put me down" anymore with your adhominem attacks, eh? Why's that, big talker?? Perhaps because I have been @ this as long as you ALLEGEDLY have, and that I can show things I've done at ALL LEVELS CONCERNED that you cannot show???
NOW, per my subject-line above:
Here's one for you, from a RESPECTED source in the realm of security, in regards to Linux & Windows security being "neck & neck", ok?
This article submission, based on words from Eugene Kaspersky tends to disagree with you, as do I!
(See my p.s. below later, where I ask you a VERY pertinent question based on YOUR STATEMENTS quoted there)
It's where Mr. Kaspersky even states Windows is as secure as Linux or moreso:
http://slashdot.org/submission/1568086/Windows-not-less-secure-than-LinuxOS-X
(That was put up as a story for submission here, in the "recent section", but it never was put onto the main page... totally "blown off" & we ALL know why! The /. "Pro-*NIX slant" around here & the trolls that help promote it, knowing most folks are "sheeple" that 'follow the crowd' because they don't know enough about a tech topic to know better!)...
---
"With all respect, I have nothing to prove to you as I have no idea who you are and actually care little of your opinion as to my skills." - by pandrijeczko (588093) on Tuesday May 31, @04:42PM (#36301390)
PROVE IT! Show us something then...
Anyone can "talk a good game" boy!
(Better still? Meet my challenge & show that you've done more & of better note + even EARLIER than I have in the art & science of computing that did well (inclusive of commercially used software on my end that is HIGHLY esteemed no less)).
Somehow I don't think you will ever be able to, and that suddenly your "adhominem attack" on myself has "run out of steam" (hot air on YOUR end is more like it, lol!).
(Anyone can "talk a big game" boy... trick is, to be able to show & prove it! You can't, & I can... simple!)
---
"I've got three decades experience in telecoms, OSes and security, I've written a few technical whitepapers in my time, developed training courses on TCP/IP, Linux, Shell Scripting and Security but beyond that I am not prepared to go into more detail - it's an illustration for you as to the depths of my skills, but I've no interest in boasting to you more specifically as to what I've done - suffice it to say, I had just started my telecoms career in 1982." - by pandrijeczko (588093) on Tuesday May 31, @04:42PM (#36301390)
Been there, done it, & apparently YOU & I have been at this the same amount of time (assuming you are telling the truth that is)...
Yet, by way of comparison? I HAVE DONE WELL & can prove/show it... you cannot!
(Big difference there)
---
"And, if I'm honest, you do sound a bit too much like a petulant child to have the maturity and experience that you claim to, so I'll take that with a pinch of salt." - by pandrijeczko (588093) on Tuesday May 31, @04:42PM (#36301390)
LMAO, omg... talk about "the pot calling the kettle black"!
Ahem: Need I refer other readers to your FIRST replies to me, adhominem attacks & all?
Take a peek here folks, after reading pandrijeczko's b.s. above:
http://mobile.slashdot.org/comments.pl?sid=2200490&cid=36300482
&
http://mobile.slashdot.org/comments.pl?sid=2200490&cid=36300672
(Two "prime examples" of this fool trying to "condescend to me", & yet he's never accomplished anything compared to myself in the art & scie
We could require people to develop on a specific platform to make the software easier to analyze, then have digitally signed software sold on a single walled-garden, only allow authorized software to run on the phone, with the phone provider able to take down and turn off any malware app as needed.
Oh yeah, that is called an iPhone!
Why's THAT? Hmmm?? Perhaps because we've both been at this approximately the SAME LENGTH OF TIME, & I have degrees in CSC & MIS, as well as a string of noted good accomplishments in the art & science of computing, and you do not???
"For the same reasons, trying to goad me into revealing more will achieve nothing, I am far too old and wise to fall for that trick." - by pandrijeczko (588093) on Tuesday May 31, @05:10PM (#36301756)
I'm far too old & wise to NOT realize that means this (translated from NIX troll-speak):
You don't have anything to show, no proofs, of your "alleged security guru status", period! Not only that, but nothing tangible that did well in the field of computing on ANY level, period!
---
"You are also getting repetitive" - by pandrijeczko (588093) on Tuesday May 31, @05:10PM (#36301756)
Repetitively POUNDING YOU INTO THE GROUND for your earlier attempts @ "condescending to me", adhominem attacking me, & more...
As well as my repetitively challenging YOU to show you've done MORE than I have, to better acclaim in respected publications & more like commercial software + trade shows etc. (which YOU blatantly RUN from!).
APK
P.S.=> Funniest part of all though, & it was on topic? Was this:
Lastly/AGAIN: I find it FUNNY how the statistics of the Linux kernel alone having more unpatched security vulnerabilities than does nearly ALL of what Microsoft offers to do business & development with "shut you up", & fast, here:
http://mobile.slashdot.org/comments.pl?sid=2200490&cid=36300850
Guess who gets the "last laugh" here? Not you... lol, you arrogant little boy!... apk
Badly here http://mobile.slashdot.org/comments.pl?sid=2200490&cid=36301882 and probably why he "changed his trolling and condescending tone" and ran.
Don't you EVER learn tomhudson? We all KNOW that you stalk & troll me by AC replies, and who said that??
Why, YOU DID, here, quoted verbatim (and instigating others to do so as well? Please... lol, you FOOL, no one!):
"Wait until he starts on another kick, then reply to him as an AC. It's the new meme". - by tomhudson (43916) on Sunday May 09 2010, @08:29PM (#32150544) Homepage Journal
QUOTED, LITERALLY VERBATIM, FROM -> http://slashdot.org/comments.pl?sid=1646272&cid=32150544
(So, if the "best you've got" is AC trolling & stalking replies to me tomhudson? Well... lmao @ U!)
APK
P.S.=> Now, on this "tidbit" from you? Who the F do you think you're fooling tomhudson??
"Nobody ever claimed that Linux was immune" - by Anonymous Coward on Tuesday May 31, @01:26PM (#36299196)
I've been around here long enough (since 2004, maybe a bit earlier) to KNOW "how it is" around here, a very "Pro-*NIX slant" to things, & Penguins are NIGH CONSTANTLY implying that "Windows is a malware ridden horror, Linuxes are not"!
Well, to THAT, specifically (& on topic about ANDROID Linux)?
Heh... see these additional "problems" ANDROID Linux has shown over time then recently:
---
A RECENT HISTORY LIST OF ANDROID LINUX EXPLOITS BY MALWARE ETC. et al:
http://www.net-security.org/malware_news.php?id=1718
http://www.theregister.co.uk/2010/11/10/android_malware_attacks/
http://www.zdnet.co.uk/blogs/jacks-blog-10017212/android-and-facebook-attract-more-malware-attacks-10022271/
http://mobile.slashdot.org/story/10/12/30/1856242/Android-Trojan-Found-Spreading-From-Chinese-App-Stores
http://www.ft.com/cms/s/2/bf3d6002-452e-11e0-80e7-00144feab49a.html#axzz1FdlXHJmB
http://www.theregister.co.uk/2011/01/29/android_data_disclosure_bug/
http://it.slashdot.org/story/11/03/01/0041203/Infected-Androids-Run-Up-Big-Texting-Bills
http://it.slashdot.org/story/11/01/29/1946202/New-Android-Exploit-Discovered-To-Steal-Data
http://mobile.slashdot.org/story/10/11/27/213219/Security-Expert-Warns-of-Android-Browser-Flaw
http://yro.slashdot.org/yro/08/11/21/1321200.shtml
http://linux.slashdot.org/story/10/11/02/2238205/Serious-Security-Bugs-Found-In-Android-Kernel
http://mobile.slashdot.org/story/10/11/05/2011243/Major-Security-Holes-Found-In-Mobile-Bank-Apps
http://news.slashdot.org/story/10/10/18/1910224/A-Tidal-Wave-of-Java-Flaw-Exploitation
http://news.slashdot.org/story/
Of course its Android so everyone here is defending it. However if the same case was with iOS or RIM you all would be downing them to the max
A user with root explicitly installing a program IS NOT A HOLE.
Yes, but a user with root explicitly installing malware is most definitely an A HOLE.
I moderate "-1, Fool"
In fact, today is a more secure era.
Back in the BBS and early internet days, download shit of random sites was the only way to install software. You had to choose wisely the place you got your software from. If you /.er wanted to get the latest compiler suite, you had to fetch it from somewhere. If grandma wanted a weather app or a smiley pack, she got it from the interwebs too, and caught a nice trojan while doing it.
Now, systems like Android, WebOS, etc. provide you a nice walled garden of vetted apps. So most users can be sure they won't get malware. Advanced users, who are more knowledgeable and probably better at telling which sources are trusted, can enable other repositories ("sideloading", "dev mode", etc.) /.er want to install some crazy experimental piece of software, you're still allowed to fetch it from somewhere. If grandma want a nice "kitten" theme for her homescreen, she simply get it from the official repository and is spared from trojan.
Thus if you
Well, except for iPhone users. They are stuck in walled garden mode. Unless they go against Apple's effort, and have to use hacks and exploits on the phone that they actually own. Weird...
BTW: It's "Plus ça change, plus c'est la même chose"
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
http://www.theregister.co.uk/2011/06/10/domains_lamped/
---
PERTINENT QUOTE:
"Phishers compromise LAMP-based websites for days at a time and hit the same victims over and over again, according to an Anti-Phishing Working Group survey.
Sites built on Linux, Apache, MySQL and PHP are the favoured targets of phishing attackers,"
---
That's JUST FOR YOU, trolls... & of course, this as well, for comparison's sake, Apples-To-Apples:
---
Vulnerability Report: Microsoft SQL Server 2008: (06/11/2011)
http://secunia.com/advisories/product/21744/
Unpatched 0% (0 of 0 Secunia advisories)
---
Vulnerability Report: Microsoft Internet Information Services (IIS) 7.x: (06/11/2011)
http://secunia.com/advisories/product/17543/
Unpatched 0% (0 of 6 Secunia advisories)
---
Vulnerability Report: Microsoft Exchange Server 2010: (06/11/2011)
http://secunia.com/advisories/product/28234/
Unpatched 0% (0 of 0 Secunia advisories)
---
Vulnerability Report: Microsoft Internet Explorer 9.x: (06/11/2011)
http://secunia.com/advisories/product/34591/
Unpatched 0% (0 of 0 Secunia advisories)
---
Vulnerability Report: Microsoft Visual Studio 2010: (06/11/2011)
http://secunia.com/advisories/product/30853/?task=advisories
Unpatched 0% (0 of 1 Secunia advisories)
---
And?
Well, We already KNOW that Windows 7 has less bugs unpatched than Linux 2.6x also (the mainstream kernel, & KERNEL ONLY, not the entirety of a Linux distro mind you, vs. a COMPLETE OS in Win7)
APK
P.S.=> Now, that's a comparison for you "Pro-*NIX trolls" around here on /.:
LAMP stacks (Linux, Apache, MySQL, PHP) being BLOWN AWAY regularly, vs. ZERO BUGS in MS' dev. stack for websites!
Again... "read 'em, & weep" (current/new news)... apk