More Malware-Infected Apps Found In Android Market

Trailrunner7 writes "For the third time in the last few months, Google has had to remove a slew of malware-infected apps from the Android Market and suspend some publishers. Ten Android apps in the Official Android Market are known to be infected, but many more could be victims of the Plankton Trojan. Researcher Xuxian Jiang claims that early variants of the Trojan have evaded detection for as long as two months."

Comments

How about...

[Skarecrow77]

you post a list of the infected applications in the freakin summary, so when TFA gets slashdotted, we know what the hell they were?

I'm just saying...

Re:How about...

[Sylak]

They aren't listed in TFA either

Re:How about...

[Skarecrow77]

I managed to get through to the article, and noticed that myself.

Wow, what useless journalism.

Re:How about...

[Azmodan]

Wish there was a way to mod down an article!

Re:How about...

[Anonymous Coward]

R.I.P Journalism.

Re:How about...

[imamac]

http://slashdot.org/recent

Re:How about...

[Skarecrow77]

Actually, I'm very torn whether to replace my original Droid with a Droid 3 or an Iphone 5 when the two do mortal battle later this year... The Iphone 4s I've used are pretty snazzy, and my wife's ipad is sweet, but dammit I LIKE android.

Re:How about...

[NatasRevol]

Well, apparently, Android doesn't like you :-)

Re:How about...

[FrootLoops]

There's a list in one of the comments to TFA. I would reproduce it here if I had any reason to trust its authenticity, but I don't.

Re:How about...

[SuperKendall]

Get an iPhone and jailbreak it. Technical nirvana.

Re:How about...

[Anonymous Coward]

Needs moar "+1, Common Sense"

Re:How about...

[CheerfulMacFanboy]

you post a list of the infected applications in the freakin summary, so when TFA gets slashdotted, we know what the hell they were?

I'm just saying...

Google will remote-wipe them from your phone anyway.

Re:How about...

[macs4all]

Well, apparently, Android doesn't like you :-)

Oh, but you're wrong! Android like him long time!

Re:How about...

[Eraesr]

From one of the comments under TFA:

• Floating Image Free
• System Monitor
• Super StopWatch and Timer
• System Info Manager
• Call End Vibrate
• Quick Photo Grid
• Delete Contacts
• Quick Uninstaller
• Contact Master
• Brightness Settings
• Volume Manager
• Super Photo Enhance
• Super Color Flashlight
• Paint Master
• Quick Cleaner
• Super App Manager
• Quick SMS Backup
• Tetris
• Bubble Buster Free
• Quick History Eraser
• Super Compass and Leveler
• Go FallDown !
• Solitaire Free
• Scientific Calculator
• TenDrip

I don't stand for the accuracy or correctness of this list though.

Re:How about...

[ByOhTek]

Yes, then you just have to worry about an OS so "secure" it can be jailbroken just by visiting a website!

QC Required

[Microlith]

Sooner or later Google will need to do some sort of Quality Control on their store, or they'll just keep making the Marketplace look even less trustworthy and push people to the Amazon store.

Re:QC Required

[localman57]

You can have a "best of both worlds" solution by have a "code reviewed" icon for app developers that want to do it. May cost money for the review process...

Re:QC Required

[tripleevenfall]

I agree. I know most slashdotters are relatively savvy users and aren't going to install the ZOMGFREEMONEY$$ app, the expanding user base guarantees that malware will get more sophisticated over time.

Sure, we could only install applications developed by a corporation we already deal with and should have an interest in keeping us happy and keeping our business by not installing malware on our devices (Sony jokes aside), but doesn't this suppress the audience for "little guy" developers? Isn't that contrary to the spirit of FOSSetc?

There definitely needs to be some review and testing on Google's part. The end.

Re:QC Required

[PickyH3D]

All that does is create an even bigger divide people the people that do it and the people that don't. And people that download half of the malware (the junk apps versus at least legitimate looking apps) are probably too stupid to recognize it anyway, thus negating the purpose unless it's done across the board.

I agree that it is better than nothing, but creating a market where the big fish will probably get rubber stamped anyway, I feel uncomfortable with the idea of suggesting a system where the little fish has to pay even more to be on equal footing.

Re:QC Required

[Anonymous Coward]

What I don't get is why Google doesn't go after the author of the apps hard. What good does suspending an account do? Jail time and a multimillion dollar fine sounds better.

Re:QC Required

[localman57]

The malware scare is going to knock the little guy off equal footing anyway. Right now the malware apps are obvious, because it's cheap and easy to create crap that morons will download. But eventually, as people get a bit smarter, the malware apps will start to look more and more like normal, decent apps. At this point, when you can't easily tell a malicious app from a non-malicious app , some users will stop downloading from little guys all together, and only trust downloads from brands they recognize.

Some sort of independent code review option will help, not hinder, the little guys in the long term. But it needs to be optional to maintain the open aspect of the Android market.

Android needs to get a lid on this now, or it will loose the mass market, because most non-tech people would find fear of malware a much bigger driver of purchasing decision than other merits.

Re:QC Required

[Microlith]

Sure, we could only install applications developed by a corporation we already deal with and should have an interest in keeping us happy and keeping our business by not installing malware on our devices (Sony jokes aside), but doesn't this suppress the audience for "little guy" developers? Isn't that contrary to the spirit of FOSSetc?

Google's Marketplace has nothing to do with FOSS. So long as they don't try to lock users out of their own devices (by barring sideloading) then it's a non-issue.

Re:QC Required

[Ash Vince]

Sooner or later Google will need to do some sort of Quality Control on their store, or they'll just keep making the Marketplace look even less trustworthy and push people to the Amazon store.

Alternatively those of us who do not mind researching apps using the internet before we install them will carry on buying Android phones. I treat my phone like my home PC, I install stuff I trust after some basic research. Since Apple are not infallible I am more willing to trust my own judgement than theirs. If I screw up, I know to blame and can learn from my mistakes, if Apple screw up I just have to trust them learning their lesson on blind faith.

Re:QC Required

[tripleevenfall]

I know that on /. you always have to couch every post with a defense for every possible pedantic reply, but in this case, I thought "FOSSetc" would encapsulate the spirit of the vaguely "open" android platform and the spirit of the enterprise as a whole.

Re:QC Required

[cavreader]

"Right now the malware apps are obvious" Pray tell how can you determine something is obviously malware unless you actually download it? And wouldn't that pretty much make everyone a moron by your definition?

Re:QC Required

[localman57]

They have better things to do. The international nature of this sort of stuff makes investigations, as well as civil and criminal court actions exceptionally difficult. Google is a technology company. They're better suited to come up with a technological solution. Most of the big wins against Spam and the like come from counter-attacking the bot-nets, not from going after the people.

Re:QC Required

[localman57]

Alternatively those of us who do not mind researching apps using the internet before we install them will carry on buying Android phones.

We need the unsophisticated users to buy the Android phones, or there won't be any. The economy of scale has to be there. If Android phones alienate the average user, then they'll end up like the N900: kick ass, but expensive and a relative hassle to get.

Re:QC Required

[Aeros]

No no no..If they start doing some type of quality control on apps that go through their 'app store' then Apple might sue since they would claim that they came up with that process.

Re:QC Required

[tlhIngan]

We need the unsophisticated users to buy the Android phones, or there won't be any. The economy of scale has to be there. If Android phones alienate the average user, then they'll end up like the N900: kick ass, but expensive and a relative hassle to get.

There will always be Android phones.

However, the problem is if the perception of the Marketplace is that it's full of malware ready to steal your phone's data and cost you a fortune in long-distance and premium phone number calls, then people may shy away from downloading any app from it. (or alternative app stores for that matter, since you can't trust that they aren't sending you malware either).

Which means to most users, Android is the phone and what it comes with - the Marketplace will simply be a "never touch" zone. Which means Android devs have a harder time.

Heck, carriers may see this and demand that Amazon be the primary marketplace allowed on the phone as a safety measure. And if that's the case, Android devs may have to submit to Amazon's even more restrictive terms.

Re:QC Required

[Anonymous Coward]

Previous Android malware apps required user permissions to execute system programs (that is, native executables). If they didn't have the "system tools" perm (iirc; I don't own an Android phone anymore) then they couldn't run the included binary which performed the escalation.

Re:QC Required

[sexconker]

Sooner or later Google will need to do some sort of Quality Control on their store, or they'll just keep making the Marketplace look even less trustworthy and push people to the Amazon store.

And the Amazon store requires people to turn on the "let anything install from anywhere" option, which is what lets the bad applications do their thing.
No need to trick the user into clicking a link / saying yes to a pop up. Everyone who has the Amazon store and uses something from it has that hole wide open.

Android NEEDS to have per-executable, granular permissions. I refuse to believe <your shitty app> needs full network access, phone state, and location data just to show me a picture of a cat.

Re:QC Required

[dudpixel]

It would even be trivial to have some form of automatic malware scanning when you submit an app, such that it will flag the attention of someone at google if there is any suspicion.

I really dont want to see long approval processes like the Apple store. Its great being able to respond to customer feedback immediately. Building up a developer-user relationship is one of the best things about the Android market, and IMO should be taken much further than it currently is.

Re:QC Required

[macs4all]

I really dont want to see long approval processes like the Apple store.

I think I heard that the average iOS app gets approved in less than 5 days.

Re:QC Required

[bingoUV]

if the perception of the Marketplace is that it's full of malware

Perceptions of non-geek do not involve words like malware. So it is only geeks' perception.

to most users, Android is the phone and what it comes with - the Marketplace will simply be a "never touch" zone

For more than a decade, downloading apps from the internet for Microsoft Windows OSes should have been a "never touch" zone. But actually it was very far from a never touch zone for "most users". No one could even beat the dancing bunny.

Re:QC Required

[Specter]

I think you're under-estimating the problem. Let's take as an example something that's probably a fairly common search in the market place: "alarm clock." When I conducted that search just now, I got 717 results back from Marketplace. I had to scroll down many pages to find one that wasn't rated at least four stars. Searching on Google gives you a bunch of contradictory opinions about so many different solutions it's difficult to decide if there's a consensus.

Apple's AppStore looks like it has a similar number of results (hard to tell; it only shows 25 at a time) but already on the first page I've got rankings that range from 3 to 5. Add in the fact that I can be reasonably confident that I can try any of those and not be pwnd by malware and the AppStore's looking a lot better than Marketplace especially if I was an unsophisticated smart phone user.

"I treat my phone like my home PC..."

Therein lies the basic problem: from a trust and security standpoint the (Windows) PC model is very very badly broken. Extending that model to mobile devices is a big step backwards. In fact, I believe most people wished their PC's behaved more like their smart phones: boots fast/always on, available when I want it, has the apps I like/want to use, secure without much effort from me, etc.

Apple gets this; Google doesn't. I had a chance to talk directly with one of Google's tablet developers a few weeks back and the idea that there's a trade-off between openness and security in the app space wasn't something he even wanted to discuss. It just wasn't on his radar; an unrestricted app store was the only way to go and there was no debating the subject. I don't think he seriously considered that security might be something that's important to his customers. When I look at Google's continued resistance to making Marketplace more secure, I don't believe his outlook is unusual.

I've said before that Google doesn't think it needs to care about this, but they should. They're leaving the door open to another third party who understands the "PC in the palm of my hand" model is a problem. Android helps to feed the data collection and correlation engine that is Google and mobile devices are becoming an increasingly important part of that picture. If they let an upstart come in and convert a frustrated Android user base they risk loosing that important input to their core business value. From where I'm sitting that's enough reason to tell developers to get stuffed and start curating Marketplace right away.

Re:QC Required

[dudpixel]

That's quicker than I thought it would be - but in any case, 5 days is a whole lot more time than 5 seconds, and is plenty long enough for someone to walk away from your app because you didn't implement a feature quick enough. not a deal-breaker for major software houses with their large testing departments but for indie developers (like me), its critical.

Re:QC Required

[macs4all]

That's quicker than I thought it would be - but in any case, 5 days is a whole lot more time than 5 seconds, and is plenty long enough for someone to walk away from your app because you didn't implement a feature quick enough. not a deal-breaker for major software houses with their large testing departments but for indie developers (like me), its critical.

That's assuming you are only going to have one sale. And I think that I've heard of apps being approved in under 24 hours. Not your benchmark of 5 seconds; but, considering the track record of iOS App Store security, I think that you would agree that it isn't an onerous delay. Apple's docs say that 92% of apps get approved/rejected in 7 days, and 95% of app updates get approved/rejected in 7 days. And it seems that the biggest part of the delay is in the input queue. When the status changes to "In Review", the average app goes live in under 24 hours.

Listen: I'm not normally a "Security over Freedom" kind of guy; but, just like I'm willing to put up with a well-regulated police force rather than have to sit up all night with a shotgun in my hands, I think that, at 350,000 iOS apps (and counting!) and no real viruses, Trojans, phishing scams, etc., not many people can make a reasonable argument that the iOS/App Store "curated collection" model isn't a good deal for 99% of users, or that the Walls of the Garden seriously affect about that same percentage of users. I can't drive my car 100MPH on city streets; but I'm willing to put up with that, because the stupid fucker driving while TEXTING on his cellphone can't (legally) do it, either.

And for the other 1%, there's Cydia (and for my car analogy, the Autobahn). So, I don't personally get what all the brouhaha is about. Don't like it, either JB your iPhone, or root your Android...

Re:QC Required

[dudpixel]

Listen: I'm not normally a "Security over Freedom" kind of guy; but, just like I'm willing to put up with a well-regulated police force rather than have to sit up all night with a shotgun in my hands, I think that, at 350,000 iOS apps (and counting!) and no real viruses, Trojans, phishing scams, etc., not many people can make a reasonable argument that the iOS/App Store "curated collection" model isn't a good deal for 99% of users, or that the Walls of the Garden seriously affect about that same percentage of users. I can't drive my car 100MPH on city streets; but I'm willing to put up with that, because the stupid fucker driving while TEXTING on his cellphone can't (legally) do it, either.

Hmmm, just like the walled garden isn't as bad as some people make out, I dont think Android is nearly as bad as your analogy indicates.

The App Store does work for its target market. The problem is that its target market is not the entire world. To you, the pros outweigh the cons, but to me, its the other way around. We all value things differently.

Android is not as insecure as you think. You dont need to "sit up all night with a shotgun" - you just need to "employ a guard". ie. use anti-malware software. Yes it sucks that google dont do more, but its not the end of the world. People hear "anti-virus" and are reminded of the crap that exists on windows. Android is different - the anti-malware software doesn't hog resources or slow your phone down. It just scans any app immediately after you install it.

If you dont want to "employ a guard" then just "dont let any suspect people in the door". If the bad apps are not inside, they cant hurt your phone.

People assume that if something made it into the App Store, it must be safe. That has been shown to be not correct on a number of occasions. Apple make mistakes too.

At the end of the day its no big deal either way - just be careful what you put on your phone. simple as that.

Re:QC Required

[macs4all]

Android is different - the anti-malware software doesn't hog resources or slow your phone down. It just scans any app immediately after you install it.

Wow! If that's all Android "anti-virus" apps do, no WONDER people are having problems!

Most of the Android malware has been on the order of personal info-stealing kind. And with that, it is not the app itself that is directly malware; but rather what that app does.

I know that most geeks recommend running a firewall on Android; and if you think that doesn't consume additional resources or in some what affect performance, I've got a bridge to sell you...

So, your great solution is to expect everyone to be ever-vigilant.That is simply an untenable solution for 99% of the public. I don't know about you, but I simply don't have the time or thing inclination to worry about every single little utility or simple little app that might strike my fancy, or present a solution to fill a need.

People assume that if something made it into the App Store, it must be safe. That has been shown to be not correct on a number of occasions. Apple make mistakes too.

I think Apple has actually made a mistake about once. And that involved an app with hidden tethering features. Hardly "malware" in the classic sense. The other times were simply not Apple's fault; they involved Jailbroken iPhones only.

Now, let's compare that track record with Android...

Re:QC Required

[dudpixel]

you're pretending apple is perfect...but I'm going to ignore that because its just silly. security via obscurity has its merits but its not the be-all-and-end-all.

No one recommends running a firewall on android. I'm a geek - and I certainly dont. What would it do, anyway? Pretty sure my phone doesn't have any open ports that I need to worry about.

The only android malware that has been noteworthy has been apps that masquerade as something else. They are easy to spot, but just in case people might be fooled, the anti-malware apps contain signature-based detection of exactly the BEHAVIOUR that you mentioned.

Its not perfect, but until now, it has been 100% successful.

The only personal info an app can steal is info you give it permission to steal. Contrast with iOS, where every app has access to all your data. Thank goodness there's an approval process.

http://www.funkyspacemonkey.com/spyphone-ni

I think you'll find that neither solution is perfect. Its a trade-off between security and freedom, you know, much like we face in the OFFLINE world.

I realize I'm going to get torn to shreds...

[NitzJaaron]

...but there's something to be said for iOS being a "closed" platform with a (mostly) strict approval process. There's a lot of controversy about apps getting blocked from the iTunes App Store, but so far there haven't been any significant outbreaks of malware/trojans like the Android platform has had. Caveat: I actively develop for both platforms, so I have no "stake" in either side. Just making a point about the open vs. closed issue in related to PII leakage risks. Let the flaming begin!

Re:I realize I'm going to get torn to shreds...

[vux984]

...but there's something to be said for iOS being a "closed" platform with a (mostly) strict approval process

Nobody has ever really said otherwise.

The complaints about the apple store are not that its closed. The complaint is that its the only store you are allowed to use. (both as a consumer and as a developer)

Re:I realize I'm going to get torn to shreds...

[zonky]

There have been trojans in the iOS store too- for example, unofficial tethering inside flashlight apps...

Re:I realize I'm going to get torn to shreds...

[Anonymous Coward]

That's not a trojan. That's an easter egg.

Re:I realize I'm going to get torn to shreds...

[zonky]

Let's just agree to call it totally unvetted functionality that apple didn't have a clue about?

Re:I realize I'm going to get torn to shreds...

[Anonymous Coward]

The closed iPhone store is a great advantage to have when you sell phones to morons."

Unfortunately, "morons" buy phones from all manufacturers and platforms.

Let's even go away from any derogatory words. Try searching the Android Marketplace for Angry Birds. You'll find apps with the same exact icon as the legitimate app. They pose as "extra levels", "cheats", or newer versions. Imagine walking into Best Buy and seeing those items. You'd imagine the software was authentic because the store (Best Buy) indirectly legitimizes them.

Google and the Android Marketplace, for now, have the benefit of legitimacy. Unless Google intervenes in a more direct way, instead of just waiting for the malware to pop up, then they will eventually lose the trust users have in their store.

Re:I realize I'm going to get torn to shreds...

[iluvcapra]

The closed iPhone store is a great advantage to have when you sell phones to morons.

No flames there.

(and to be fair, as the latest Mercedes commercials featuring drivers crediting the car for bailing them out from being idiot drivers demonstrates, it's not just in electronics).

You're right, we'd all be better off if these people and their passengers were dead, or better yet, quadriplegics on disability.

If Apple wants to market their phones to morons by basically saying "don't worry, we'll protect you from your own stupidity,"

God grant me the serenity to accept the stupidity we cannot change, the courage to change the stupidity I can, and the wisdom to not consign people who don't meet my standard of intelligence to ruin, misery, and death.

Re:I realize I'm going to get torn to shreds...

[shadowfaxcrx]

I'm probably dumb to reply to this, because I somewhat suspect you're trolling but...

(and to be fair, as the latest Mercedes commercials featuring drivers crediting the car for bailing them out from being idiot drivers demonstrates, it's not just in electronics).

You're right, we'd all be better off if these people and their passengers were dead, or better yet, quadriplegics on disability.

How about we'd be better off if they paid attention to their driving instead of texting or talking or whatever else they were doing to require electronic overrides to prevent their stupid driving?

The rest of your reply just indicates you need to look up the definition of "flame."

Re:I realize I'm going to get torn to shreds...

[element-o.p.]

(and to be fair, as the latest Mercedes commercials featuring drivers crediting the car for bailing them out from being idiot drivers demonstrates, it's not just in electronics).

You're right, we'd all be better off if these people and their passengers were dead, or better yet, quadriplegics on disability.

There's a problem with that. I was reading an article recently -- I think it was in the most recent issue of Motorcyclist magazine -- that claimed that accident and accident fatality statistics don't seem to support the claim that improved technology actually makes the roads any safer. According to the article, safety equipment like seat belts, ABS, traction control, helmets, neck braces and body armor (the last three more for motorcyclists than drivers, obviously) can certainly have a pronounced affect upon motor safety IF PEOPLE DON'T CHANGE THEIR DRIVING HABITS . Unfortunately, the increased perception of safety causes people to drive in such a way as to escalate the risk back to approximately the same level it was before the safety equipment was installed. Now that people feel like they have a safety net that will "keep them out of trouble", they will tend to push the envelope harder, which ends up putting the risk level more or less back to where it was before the safety equipment was installed.

In other words, you can try to find a way to protect stupid people (and to be fair, I've been one myself more often than I'd like to admit) from themselves, but you're probably not going to be able to stop someone who is sufficiently stupid and/or motivated.

Re:I realize I'm going to get torn to shreds...

[Anonymous Coward]

Hmm. That's an illusion of security. Check this out - http://www.macrumors.com/2011/06/15/passcode-collecting-app-pulled-from-app-store/ .

Recent happening - app was able to harvest users' pass codes, it became a news item, then Apple realized it and pulled the app. So no flaming is required that Apple's closed app store can't prevent malware.

Re:I realize I'm going to get torn to shreds...

[swb]

Real World Data Point:

I drive a Volvo S80 with "Collision Avoidance" which is very similar to the Mercedes technology; it uses some kind of radar, coupled with the car computer to figure out if your current speed/acceleration might result in a collision with the object in front of you, using the radar to measure its distance.

If you meet the criteria, it sounds an audible and visual warning and pre-charges the brakes

I thought it was kind of BS, but there have been a couple of incidents where I think it has saved me from rear-ending the car in front of me.

Both times it was in stop-and-go traffic where you'd speed up to about 40 before you had to come to a near complete stop, usually quickly, and in kind of overcast, flat lighting making the distance in front of you hard to judge, especially at low speeds with quick stops.

Does it enable jacking around with your cell or something? No, it only "works" when you're legitimately about to nail someone and it doesn't give you enough breathing room unless you're actually paying attention.

Re:I realize I'm going to get torn to shreds...

[ColdWetDog]

I'm really suspicious of the statement that improved crash technology doesn't 'work'. I'm too busy to go look up the US stats but I'm under the impression that auto fatalities ARE dropping. Part seems to be clamping down on drunk driving, part seems to be the newer vehicles. I work as an ER doc and I've seen some really trashed vehicles result in very minor injuries. I know that's anecdotal but I've seen lots of car wrecks over the years.

Now, I think the accident rates haven't changed that much and there well may be something to your assertion that people are using the new technology as a crutch, but once you've gone over the edge, crumple zones, harnesses and air bags do work to keep you out of my clutches.

Re:I realize I'm going to get torn to shreds...

[Xaedalus]

I agree with you. Morons are morons, shadowfaxcrx. But you're talking about someone's loved ones who aren't as smart as we are (possibly including yours). Hearing that your father, mother, brother, sister, son, daughter, grandfather, grandmother, etc are stupid morons who deserve the fates they get is really, really harsh. If you're willing to look your family member/friend in the face and call them a stupid moron for downloading what they thought was a reasonable app (let's just concede that anyone who downloads tentacle porn apps or screaming Japanese girls does get what they deserve - it's not a zero sum game here), then yes, you are perfectly entitled to tell the whole world that approximately half of its population is on the wrong side of the bell curve.

Just be ready to pay the emotional price of hurting someone's feelings, pride, or undermining their sense of self-confidence. It's a bitter price to pay, because I've done it. And I've regretted it ever since. Sometimes the illusion of competence is the only comfort one has.

Re:I realize I'm going to get torn to shreds...

[Anonymous Coward]

...but there's something to be said for iOS being a "closed" platform with a (mostly) strict approval process

Nobody has ever really said otherwise.

You must be new here.

Re:I realize I'm going to get torn to shreds...

[bonch]

The complaints about the apple store are not that its closed.

What Slashdot have you been visiting?

Re:I realize I'm going to get torn to shreds...

[Anonymous Coward]

We have been trained by the PC world to download software only from someplace we trust, like the manufacturer's web site. We just assume that the Android marketplace is trustable, so we don't pay too much attention to what's happening during the install. We're quickly finding out it's not trustable!

Also, I hate when apps use another companies name in their title to get you to think they're an official app from that company. This is sleazy, and I'm guessing that you won't find such things in the iPhone world.

GOOGLE! Clean up your mess! Review these apps, even if you have to charge the dev's, and they pass the price to the rest of us.

Re:I realize I'm going to get torn to shreds...

[node 3]

...but there's something to be said for iOS being a "closed" platform with a (mostly) strict approval process

Nobody has ever really said otherwise.

The complaints about the apple store are not that its closed. The complaint is that its the only store you are allowed to use. (both as a consumer and as a developer)

Um... The part you quoted said 'iOS being a "closed" platform'. Your correction is just a restatement of that.

But, since it sounded like a way to complain about Apple, without having to acknowledge their model works, +5 Insightful!

Re:I realize I'm going to get torn to shreds...

[node 3]

The complaints about the apple store are not that its closed.

What Slashdot have you been visiting?

The one were complaining about Apple's "walled garden", while simultaneously avoiding saying anything that might make it sound like a good thing for the customer, is worth +5 Insightful, regardless of linguistic gymnastics or factual inconsistencies involved.

Apple's model for iOS has worked out fantastically. iOS outnumbers Android close to 2 to 1. Yet somehow, according to slashdot nerds, this model doesn't work well for consumers, and they are clamoring for alternative app stores.

Re:I realize I'm going to get torn to shreds...

[shadowfaxcrx]

I appreciate what you said, and hope you don't have the impression that I go around seeking out stupidity and yelling "moron!" at those who do something dumb.

I have, however, been known to tell people (yes, including my mother) that something they did was dumb. In fact, I've even told her that it was dumb to download random games off the internet without checking to see if they're legit first. I told her that after wiping and reinstalling Windows for her (again) not because I think she is an idiot, but because she kept doing dumb things and then getting angry that her computer broke because of them.

I think we've diverged a bit from my original point anyway, which was that while (yes I did use the word) phone-security morons might need the crutch of a completely locked down app store that the iPhone grants us, the rest of us do not. That iPhone caters to the less security-savvy amongst us is not a black mark on that platform, but by the same token Android should not be bashed for *not* catering to such people. "Android's dangerous!" is bullshit. It's fine, as long as you check to see what the apps you install want to do, and verify that they want to do it for a legitimate reason.

Regarding offending people with the term moron, I have no problem admitting that I'm a moron in certain areas. Buying jewelry for the SO would be one of them. I tell people I don't know a carat from a carrot, and have absolutely no idea whether the price a store charges for a bauble is a fair price (beyond the blanket assumption that it's a retail store and so therefore, no). I have no idea how to tell if a diamond is good or not (or even if it's real - I can't tell a real one from cubit zirconium to save my life). Being a jewelry moron, I'm a jeweler's dream customer, because he could sell me sparkly glass in a brass ring and I'd probably never know the difference. But, being a jewelry moron, when I go shopping for such things, I grab someone who is *not* a jewelry moron and take them with me, and they keep me out of trouble.

That's the point I'm trying to make regarding smart phones. If you're a security moron, whether because you're actually stupid or because you just can't be bothered to find out about proper security basics, then I'd submit that you really are pretty stupid if you don't grab someone who does know what they're doing and ask if what you're about to install on the device that has all your contacts, and probably has your credit card and bank account information, and is capable of transmitting all of that over the internet, is safe. If you can't manage even that, then you need an iPhone, and even then you should be nervous about getting into trouble.

And so I stand by what I said originally, but I will point out that, in keeping with your post, what I say here does not represent what I say to people's face when they break their smart phone. I do have a smidgen of tact (though I can be a moron in that arena as well from time to time ;) )

Re:I realize I'm going to get torn to shreds...

[node 3]

Let's just agree to call it totally unvetted functionality that apple didn't have a clue about?

And let's also be honest about the fact that it wasn't malware, quite unlike what is being discussed here on the Android Market.

Trojans are a type of malware. The flashlight tethering app wasn't malware. If you want to call it a trojan because it had hidden, but non-malicious functionality, feel free. But don't act like that's what people are talking about when they say 'malware' or 'trojan'.

Re:I realize I'm going to get torn to shreds...

[Xaedalus]

Ye Gawds, a thoughtful, courteous, and polite response that ends a debate on /. ! Thank you for the response, and the clarification. Your point is well made, sir. Now you'd better run for the hills, because I believe this thread marks the coming of the End of the World, where the Great Old Ones return to eat our brains.

Re:I realize I'm going to get torn to shreds...

[vux984]

Apple's model for iOS has worked out fantastically. Yet somehow, according to slashdot nerds, this model doesn't work well for consumers, and they are clamoring for alternative app stores.

Go on, let people choose alternate app stores freely... if nobody wants them, then the market will take care of them quickly enough, right?

Hell, even despite being driven almost underground the alternative app stores are thriving? How exactly does that reconcile with your claim that people aren't clamoring for them?

Re:I realize I'm going to get torn to shreds...

[element-o.p.]

I know these comments are kind of old, but here's the info on the article I referenced in my comments above, just in case you are interested:

"Risk Compensation", in the "Street Savvy" section of Motorcyclist magazine, July 2011, by Ben Purvis.

Re:Ha Ha Ha

[localman57]

Did you send this from an Android phone? It appears that a trojan is stealing some of the words out of your sentences and sending them to a server somewhere.

What the

[vajorie]

Why do you not link to the original article?!

Re:What the

[Pollardito]

That doesn't have the list of apps either. The internet is broken.

Re:What the

[Anonymous Coward]

Some malware has even gone so far as to prevent its detection by removing references to itself on the internet.

Re:What the

[idontgno]

I can see this malware has also downmodded your analysis of its behavior to +0 and converted your helpful post into an anonymous coward post. That is some kind of powerful malware!

Bot related?

[munozdj]

TFA says that this malware leaks a list of granted permissions and prompts the user to install a .jar in his/her device. If the user does install it, the device becomes a zombie. What would the course of action be if your Android phone is infected? Keep in mind that smartphones are kind of the ideal botnet zombie for a DDoS attack since they are always on and, presumably, have access to the network. I think it's time for a good Android antivirus/malware/spyware/thingware or for a tighter app publication process from Google.

Re:Bot related?

[zonky]

Dialling premium rate numbers, obviously. Malware apps are totally useless anyway - if they rely on signature-based detection.

Same as for regular computers

[TyFoN]

You wouldn't install Schkype from Mr Hong on your PC and you should not do that on the phone either!

Re:Same as for regular computers

[idontgno]

Good point. I usually prefer Panaphonic products, especially since I'm boycotting Sorny and generally unhappy with the product quality from Magnetbox.

Re:Same as for regular computers

[Freultwah]

On a similar note, my last Recbok sneakers broke in half and the Neki sweatshirts were conspicuously tissue-thin. It's a good thing I found Adibass to replace it. Now if I could find a BAFS or DTK tape for my Panascanic personal cassette player...

Re:Same as for regular computers

[the_psilo]

You, my friend, need a Carnivalé.

15 Seconds Quality Time with Google...

[idontgno]

turns up Sophos' analysis of this "Plankton" malware.

The sample of the EULA associated with the malware app (yes, malware EULAs) lists "Angry Bird Cheater" by name, so there's one of the candidates. Also, quoting the article:

The code suggests that it is a platform, but it does not disclose its purpose. Descriptions of the apps pulled from the Android Market contain the text:

This application is brought to you free sponsored by Choopcheec Platform. It adds a search shortcut on the home screen or application screen.

So, "Choopcheec" seems to be a common codeword for the apps. Whatever that is.

Re:15 Seconds Quality Time with Google...

[idontgno]

AAaaaand, another 10 seconds with Google tells me "choopcheec.com" has sample EULA text like the one above for one other product that Google can find: "Can You Drive".

Re:15 Seconds Quality Time with Google...

[idontgno]

OOOH, the off-market AndroidZoom app website seems to not have pulled any apps down in response to this fiasco. Searching the site for "Choopcheec" returns this:

Angry Birds Cheater by Crazy Apps
Chit Chat by Crazy Apps
Snake Kaka by Phill Dig
Angry Birds Rio Unlock by Crazy Apps
Favorite Games Backup by Crazy Apps
Gun Bros Helper by Crazy Apps
Call Ender by Crazy Apps
Angry Birds Multi User! by Crazy Apps
Bring Me Back My Droid! by Crazy Apps
Shake To Fake (Fake call) by Crazy Apps

That's 10 apps... maybe that's the rogues' gallery?

ats;dr

[NotSanguine]

In case you're wondering, that's "Author too stupid;didn't read"
When I saw that the author apparently didn't know the difference between 'affect' and 'effect' I gave up.
IMNSHO, If you can't get that right, you don't deserve to be read.

Re:Ha Ha Ha

[sakdoctor]

This is valid grammar 2.0

makes ya wonder

[Anonymous Coward]

if you really need a phone "smart" enough to catch malware.

they do still make phones that are just phones, ya know.. those fancy and expensive i-this and e-thats may look cool, but when your phone is working when everybody elses' is infected with something is way cooler.

Re:makes ya wonder

[idontgno]

Well, you know, I don't especially need a phone. That's for talking to people, and what's the fun in that?

Now, getting into a Wikipedia edit war while driving down the road and eating a Sonic burger... That's fun!

Seriously, though. My HTC isn't a phone, it's a portable computer with telephony capability that I occasionally use.

In other words, you're talking about solving the wrong problem. You want phones that are immune to malware, and as you point out, they're still thick on the ground. I want an ultraportable computer that doesn't get hacked, trojaned, or otherwise attack me without provocation. That's a bit harder.

Your arrogance marks YOU as the real moron

[DavidinAla]

Your comment is indicative of the kind of arrogance that makes people hate so many technically proficient people. Do you even realize how arrogant you are to call people "morons" because they don't happen to have the kind of technical understanding and knowledge that we have? I'm sorry, but it's YOUR ARROGANCE that marks you as the real moron. People have different skills and knowledge. Yours (and mine) happens to be in a technical field, among others, presumably. But you have areas where you don't know anything, too. Everybody does. Just because people don't value YOUR subject area above all others doesn't mean they're morons who are "dumb users." Just as a person who doesn't want to be an auto mechanic isn't a moron when he simply wants his car to work without him futzing with it. You really need to climb down from the high horse and realize that people aren't necessarily morons just because they don't know everything about IT that we know.

Re:Your arrogance marks YOU as the real moron

[Anonymous Coward]

I'll second that emotion!!

Re:Your arrogance marks YOU as the real moron

[flibuste]

I think you're jumping way too high in calling your OP Arrogant or anything.
I am sorry, but the last batch of apps that were removed from the Market contained applications with names such as "Screaming Japanese Girls". If you install those kind of apps on your phone, no one else than yourself can be blamed if you get a malware with it. And in all honesty, the category of people who would download those could fit in the "moron" category - nothing to do with being tech-savvy or not.
The aformentioned tech-savvy people spent YEARS trying to explain to the general public that there is a danger in downloading random crap from anywhere to any device. Some people will never learn. "Moron" is a good term for the later IMHO.

Re:Your arrogance marks YOU as the real moron

[TheCRAIGGERS]

But he's also quite right.

To tack onto your car analogy, people who know a lot about cars often mod them to their desires. People who don't know a lot about cars don't normally tweak their shocks, install aftermarket sensors, NOS, or any of the other crazy shit people do nowadays. Or if they do, they hire somebody to do it for them. The day I install a NOS into my jeep is likely the day before my fiery death and I thankfully know this. People need to realize that installing random shit onto their phones without at least consulting the security screen are asking for pain.

To put it bluntly, these smartphones are computers. They are now no longer different than a PC, except for possibly the fact that they contain even more personal data than a typical computer does. iPhones are not immune to this either, as evidenced by the story earlier today where the app was sending passcodes to the guy's server. Don't you think a code review would have turned that up?

I would say that this is something that Google will likely have problems with in the future, but PCs are still going strong and Android is stronger than ever. Virus scanners have already come out, and I'm sure more are on the way. Google will likely tweak their OS in some attempt to limit the damage these apps can cause. But in the end, consumers need to get smarter. I'm not going to call them morons, but they are figuratively playing with fire when they do their banking on the same device they download porn apps on. Eventually, as the decades pass and the baby boomers begin leaving us, this problem will probably lessen and a new one will pop up in its place.

Re:Your arrogance marks YOU as the real moron

[shadowfaxcrx]

I understand that today's society encourages us to tell everyone that they're special and smart and wonderful, even when they're not. I don't subscribe to that theory, however, and object to being labeled as arrogant because of it.

You're right. There are plenty of areas that I know next to nothing about. I am, however, smart enough to know that I don't know much about those areas, and so I ask questions if it's an area I plan to get into.

Your post is like suggesting that someone who doesn't know how to swim is not stupid for cliff jumping into the ocean.

There are things in life that, if you want to do them, you need to learn about them. If you want to drive a car, you must first learn how before unleashing yourself on the road. If you want to cliff-dive, it's a really good idea to find out about that swimmin' thing before you do it. To do otherwise would be stupid.

Your auto mechanic is actually a really good example to my point. I certainly am not suggesting that everyone who drives should learn how to fix their car. I am, however, suggesting that maybe reading the owners manual, especially the part where it says "get the oil changed every X miles to avoid engine damage" would be a really good idea. By your logic, someone who buys a car, doesn't change the oil for 50,000 miles, and then bitches that his car don't work no more, should be viewed as gifted. I reject that logic entirely.

And it's the same with technology. If you want to play with computers, then you need to learn a few basics. If you want to download tentacle porn apps for your phone, you should know how to check for basic permissions. Does tentacle porn need to read my contacts? Gee, why would tentacle porn need to know my whereabouts? Huh, tentacle porn wants permission to email people? I wonder why that could be.

If you get into a field that you don't know much about, and then get upset when you get burned because you couldn't be bothered to find out about it, then yes, you are a moron.

Re:Your arrogance marks YOU as the real moron

[element-o.p.]

Elitism certainly is a black mark upon technical fields, you're right. But I'm not entirely sure I disagree with shadowfaxcrx. Here's the rub: if you want to use *ANY* product, there is a minimum skill set required to use it. Ever see toys with the label "Warning: not for use by children under three (or five, or seventeen) years of age!" or household appliances that say "Adult supervision required"? Or, to drive a car, you must first prove to the DMV that you have the necessary skills and judgment to do so safely. At some level, a smart phone -- or any networked computer, for that matter -- shouldn't really be any different. If you want to use the device, you should take the time to learn at least a little bit about how it works and what potential hazards there are to its use.

I'm not saying that everyone who wants to use a smart phone should obtain a professional network admin-level skill set before they are allowed to purchase one, but as shadowfaxcrx said, understanding that "a scientific calculator does not need to read your contacts or see your location" to work isn't exactly rocket science.

Re:Your arrogance marks YOU as the real moron

[david_thornley]

Okay, when was the last time you saw a computer with a warning sticker? Or a requirement to show a license and insurance? Heck, does it say on the Google Apps Mart (or whatever) that the apps may be dangerous?

If we're going to market computers and smartphones as if they were completely safe, people will use them as if they were completely safe. There's too many complicated things out there for everybody to keep track of all dangers themselves. I know something about the dangers of software, but there's a whole range of dangers out there I don't know of, and in a situation I'm not familiar with I'm likely to do something that any expert would consider dumb.

Re:Your arrogance marks YOU as the real moron

[Anonymous Coward]

I understand that today's society encourages us to tell everyone that they're special and smart and wonderful, even when they're not. I don't subscribe to that theory, however, and object to being labeled as arrogant because of it.

You're right. There are plenty of areas that I know next to nothing about. I am, however, smart enough to know that I don't know much about those areas, and so I ask questions if it's an area I plan to get into.

Your post is like suggesting that someone who doesn't know how to swim is not stupid for cliff jumping into the ocean.

There are things in life that, if you want to do them, you need to learn about them. If you want to drive a car, you must first learn how before unleashing yourself on the road. If you want to cliff-dive, it's a really good idea to find out about that swimmin' thing before you do it. To do otherwise would be stupid.

Your auto mechanic is actually a really good example to my point. I certainly am not suggesting that everyone who drives should learn how to fix their car. I am, however, suggesting that maybe reading the owners manual, especially the part where it says "get the oil changed every X miles to avoid engine damage" would be a really good idea. By your logic, someone who buys a car, doesn't change the oil for 50,000 miles, and then bitches that his car don't work no more, should be viewed as gifted. I reject that logic entirely.

And it's the same with technology. If you want to play with computers, then you need to learn a few basics. If you want to download tentacle porn apps for your phone, you should know how to check for basic permissions. Does tentacle porn need to read my contacts? Gee, why would tentacle porn need to know my whereabouts? Huh, tentacle porn wants permission to email people? I wonder why that could be.

If you get into a field that you don't know much about, and then get upset when you get burned because you couldn't be bothered to find out about it, then yes, you are a moron.

Stop being so arrogant. Even you trust things will work without learning about how they work. It happens everyday. It's the principle of abstraction, the very same principle that allows us to have computers with software in the first place. It works at every level.

Part of your fallacy is thinking others have the same interests as you. For instance: are you a moron when you get sick for not knowing how to prevent it?

Re:Your arrogance marks YOU as the real moron

[shadowfaxcrx]

Depends. If I pick up a jar labeled "biohazard" and open it without finding out what the stuff inside might do to me, or finding out how to properly handle jars with such labels, then yes, yes I am.

There's no fallacy here. People complain when their phone gets jacked. People use their phone. People don't bother learning the basics about using their phone so it doesn't get jacked. That's dumb.

Re:Your arrogance marks YOU as the real moron

[tooyoung]

I understand your point (and the other replies at this level). I would say, it is becoming harder and harder to justifiably recommend an Android phone to a non-technical user. I would say, "try Android, it is a better choice than an iPhone, as you avoid the walled garden." However, based on many of the comments I've read on /. lately, I'm not sure this is a good thing:

-if they buy most Android phones, they find themselves locked into an even worse experience because of the crapware and lock-in that most every Android handset maker provides.
-they could unlock the phone. As trivial as this seems to you and me, if they can't do it with a single click button that is provided by default on the phone, it is likely too confusing.
-once they do unlock the phone, what are they supposed to do with it? Load cool apps that they find on the internet? As you point out, they lack the technical knowledge to understand the consequence.

The end question becomes - what does a non-technical user gain from us recommending that they buy an Android phone? What is the benefit over an iPhone? Are we trying so hard to stick it to Apple that we lose sight of the fact that the iPhone may really be the best choice for the non-technical user? Not trolling at all here, I'm curious what justifications people are using.

Re:Your arrogance marks YOU as the real moron

[shadowfaxcrx]

I'm with you. I don't recommend Android to strangers. If you come up to me asking which smart phone you should buy, that's a good sign you don't know much about smart phones and so you should probably get an iPhone, because if you were tech-savvy you'd already know what you wanted. If it's someone I know, I'll only recommend Android if they're reasonably competent with tech toys. I don't even mean "able to root a phone successfully." I just mean "able to read "this app wants to read your contacts" and determine whether or not the app should be doing that. Otherwise, I recommend iPhone too. As I've said elsewhere in this expanding thread, I have no problem with iPhone and it's catering to tech-inept people. I have a problem with iPhone people running around yelling that Android is dangerous because it doesn't cocoon them in virtual bubble wrap.

Re:Your arrogance marks YOU as the real moron

[node 3]

I understand that today's society encourages us to tell everyone that they're special and smart and wonderful, even when they're not. I don't subscribe to that theory, however, and object to being labeled as arrogant because of it.

Yes, clearly you've been told you are "special, smart and wonderful" a few too many times growing up. Your head is the size of a planet.

Not being a tech nerd does not relegate one to being a moron. You *are* being arrogant. You can't see the difference between being ignorant and being a moron. You can't seem to grasp that not everyone is going to have the same interests and motivations as you. For every person you are calling a "moron" simply for being as interested in tech details as you, there's something they know that would equally make *you* a moron, going by such standards.

The idea that Apple is designing their products for morons is extremely arrogant. You don't have to be a moron to appreciate quality design and things working well without having to dink around. In fact, I agree with the first person responding to you in this subthread, your assertion strikes me as much more moronic than what you are trying to claim of people who are simply not as tech savvy as you'd like.

Re:Your arrogance marks YOU as the real moron

[node 3]

Depends. If I pick up a jar labeled "biohazard" and open it without finding out what the stuff inside might do to me, or finding out how to properly handle jars with such labels, then yes, yes I am.

Sorry, I must have missed the part of this story where malware is marked as "Warning: Malware".

There's no fallacy here. People complain when their phone gets jacked. People use their phone. People don't bother learning the basics about using their phone so it doesn't get jacked. That's dumb.

Yeah, it's *really* dumb of people to not know how to tell what's a trojan or not! I mean, it's really simple, you just sorta "know" when something looks suspicious, and with a little digging, bam! you now know if it's a trojan or not. I mean, *anyone* can do this, right? All you have to do is keep up on current malware trends, and have used enough software to tell the difference of what seems legit or not, including being able to be suspicious of new types of malware that are becoming increasingly well disguised!

You live and breathe tech. You're a nerd. What is second nature to you is magic to the non-nerd. Just blanket calling most non-nerds 'morons'... how is that *not* arrogance?

You know, maybe people just aren't that interested in tech details? Perhaps they don't want to become systems integrators, and just want something reliable and trustworthy? Something like what Apple offers? And why shouldn't they? That's not being dumb, stupid, or moronic. It's being smart. Why spend time unnecessarily studying something they have no interest in, when they can have someone else do that for them?

Do *you* personally check up on the sources of all the food you buy? Do you personally verify the safety of the electronics you buy? Do you make checks on the sources of the medicines you buy? It's not stupidity or being a moron to find value in having others do the checking for you.

Re:Your arrogance marks YOU as the real moron

[shadowfaxcrx]

I'm growing tired of responding to the same points over and over, but I'll point out something that you're not getting:

"ignorant" has two components: Willful, and natural. I don't fault people for natural ignorance. I do fault them for willful ignorance, in which they decide to get involved with something, be it smart phones, computers, cars, or politics, with out bothering to find out anything about it, and then complain because they (intentionally) didn't know how it worked, and screwed it up.

What you, and several others in this thread, can't seem to grasp is that I understand that not everyone is going to be tech savvy. That's fine. But if you don't want to be tech savvy, by which it seems you guys mean "refuses to learn anything about technology" then why are you buying technology?

Why is it that someone who'd never had a flying lesson, but who bought a plane and crashed it because he chose not to learn to fly it would be considered an idiot, but someone who doesn't know anything about smart phones but who buys one and then gets in trouble because they *actively chose to avoid learning about it* is not?

No one can know everything about technology. There's nothing wrong with that. But if you *actively choose to avoid learning about your equipment,* and then you run in and randomly push buttons, and then you run around yelling that your equipment sucks because it broke after you randomly pushed buttons because you *actively chose not to learn how to use it,* then yes, you're stupid. End of story.

The whole point about Apple is that they've set their phone up to protect people from themselves. The tradeoff is that some legitimate apps that are not security risks, such as tethering, may not be available on the iPhone. For iPhone users to sit there and point at the Apple app store and say "see? It protects me from screwing up my phone because I can't be bothered to learn about security and therefore it's inherently superior to the Android app store which assumes its users are going to find out how to use their phone properly" is ludicrous.

Re:Your arrogance marks YOU as the real moron

[shadowfaxcrx]

I mean, it's really simple, you just sorta "know" when something looks suspicious

Well, yes, it is, and you don't have to keep up on malware trends to do it. If you find a calculator that wants to read your contacts, and use the internet, and access your GPS location, and send email, it's pretty damned obvious that a calculator would not need to do these things and therefore there's something suspicious about it. No, you don't know for certain that it's a trojan, but you damn well know that it's suspicious and so you find another calculator that doesn't want so much free reign on your phone. Android makes it easy even for the non-tech savvy to filter out probably 99% of the malware on the app store. Just read the damn permission screen that flashes up EVERY time you hit that download button. That's all you have to do, is read. It even puts a big old warning triangle and exclamation point next to the permissions that might be dangerous. The trouble isn't that people are mentally deficient, or even technically ignorant. The trouble is that people don't bother to read. They don't bother to look at the warnings that they are provided, and then they download something bad, get in trouble, and want to blame Android when it's their own fault.

Look at the lists of apps that these articles are listing to show us how anarchic and dangerous the Android app store is. A lot of 'em are porn slideshows. There's a calculator on there. A smattering of other types of apps, none of which would need to read contacts, send email, and trace your location. I don't need a PhD in compsci to figure out that a slide show of naked women should not need to email anyone. I don't need a genius-level IQ to figure out that if a slide show of naked women wants to email people, it might just not be on the up and up.

I am not saying that these people are morons in the sense that they have a sub-average IQ. I am saying that they are morons in the sense that they can't be bothered to learn about their equipment, and then go around trashtalking Android because they got in trouble through their own willful ignorance.

Re:Your arrogance marks YOU as the real moron

[shadowfaxcrx]

Are you one of those people who thinks we should have a warning label on anything that could possibly be hazardous? I mean, squirt guns don't have a label telling you not to take the trigger off and jam it in your eye. Are you saying that someone who does that is not stupid?

element-o-p got what I was saying precisely. If you use anything, at all; Smart phone, skateboard, saw, glue, anything, you should familiarize yourself with it just on a basic level. As element said, you don't need to go out and get an IT degree to use a smart phone, but it wouldn't hurt to read the information you are given about it, which is written in plain, non-nerd English, and will help you avoid most if not all of the trouble spots.

Re:Your arrogance marks YOU as the real moron

[BasilBrush]

To tack onto your car analogy, people who know a lot about cars often mod them to their desires. People who don't know a lot about cars don't normally tweak their shocks, install aftermarket sensors, NOS, or any of the other crazy shit people do nowadays. Or if they do, they hire somebody to do it for them. The day I install a NOS into my jeep is likely the day before my fiery death and I thankfully know this. People need to realize that installing random shit onto their phones without at least consulting the security screen are asking for pain.

And the way your typical non-petrolhead avoids random shit getting installed in their cars is by having the servicing done by the manufacturer's local authorized dealer. Not by going to a generic parts shop and examining the parts for suitability.

iPhones are not immune to this either, as evidenced by the story earlier today where the app was sending passcodes to the guy's server. Don't you think a code review would have turned that up?

http://amitay.us/blog/files/big_brother_removed_from_app_store.php

No, a code review wouldn't have turned it up. Even when you have big development teams actively reviewing each others code, only a proportion of code ever gets reviewed. It's just not feasible for an app store to have reviewers exhaustively code reviewing every app. Even if they had access to the source code, which they don't.

Apple app reviewers check out the the app by running it, and seeing that it performs as advertised, and doesn't have any obvious bugs or things against the rules. And they run some automated analysis of the binaries, which finds any use of private APIs and presumably check for any other bad stuff that an automated scanner possibly can check for,

Here we have an app author collecting a 4 digit number from users, and transmitting it over the net to his server. No reason for the app review process should have caught that. But note they have done the right thing and removed it from the store as soon as they were made aware of the issue.

the real question is this

[Anonymous Coward]

How will google solve this problem? Are they going to start evaluating and testing all apps before users can buy it? If the android app market is going to thrive in the long term, the issue has to be addressed. Google has to do a better job regardless of what other platforms do or don't do.

From TFA:

[PopeRatzo]

Google has historically taken a hands-off approach to policing the Android Marketplace. It will suspend and remove suspicious or malicious applications when they're reported, but does not vet applications prior to posting them, as Apple does with its AppStore.

Ah, that's what the story is really about. I'm surprised it took them so many paragraphs to get to their real agenda.

localman57 has the solution. And who's to say that Google has to be the one doing the code reviewing? Why couldn't a group of Android developers get together and set up a reviewing panel that will certify apps as threat-free? Before I download an app, I can see if the reviewing panel lists it or not and have that one extra data point with which to make my decision. If the panel's work is done in a transparent manner, people would trust it and they would have a measure of safety without having to be walled inside.

Re:From TFA:

[localman57]

It doesn't have to be Google. But there really needs to be a single reviewer source. Think "Underwriters Laboratories" for software. Otherwise, the malware writers just setup their own review boards, and stamp it quality. As Tommy Boy once said:

I can take a shit in a box, and mark it guaranteed, but then all you'll have is a guaranteed box of shit.

You (and your friends) can't be allowed to stamp your box.

Google would be the obvious choice, though, since they have the biggest investment to lose if this all goes to hell.

Re:From TFA:

[gumbi west]

And the reviewing panel would probably do a great job for 2 months or so... and then they push back against crap code (because it would be harder to detect trojans in it if you can't tell what the heck it is doing) and then the developers would push back because the panel isn't supposed to comment on their code, just certify it as trojan free. Then they would either stop being a clearing house or would approve an app with a trojan in it, and by this time everyone would have just purchased an iPhone.

Re:From TFA:

[H0p313ss]

But then you have to worry about who guards the guardians?

Re:From TFA:

[PopeRatzo]

But then you have to worry about who guards the guardians?

Sure, but that's what transparency is for. And there will be a lot of eyes on them.

It will become clear pretty quickly if the "guardians" can be trusted.

Re:From TFA:

[node 3]

Sure, but that's what transparency is for. And there will be a lot of eyes on them.

It will become clear pretty quickly if the "guardians" can be trusted.

The only reliable guardians so far seems to be Apple. You're right that there needs to be some sort of QA panel for Android, but the only reason there's a call for one is Google's inability to do the job themselves. It's their store, after all.

You can bitch all you want about a "walled garden", but at least it serves the consumer.

Re:From TFA:

[PopeRatzo]

The only reliable guardians so far seems to be Apple.

Nothing I can say can make my point any better than that.

Re:From TFA:

[Anonymous Coward]

Google has historically taken a hands-off approach to policing the Android Marketplace. It will suspend and remove suspicious or malicious applications when they're reported, but does not vet applications prior to posting them, as Apple does with its AppStore.

Easy solution in two words ... PROSECUTE OFFENDERS.

Re:From TFA:

[polymeris]

Why couldn't a group of Android developers get together and set up a reviewing panel that will certify apps as threat-free?

Your ideas are intriguing to me and I wish to subscribe to your newsletter...

Seriously, that could even work as business model, and, on the side, foster development of OSS (because those apps would be easier to review).
The dangers of haxxors & trojans in mobile platforms has been in the news a lot lately [here at least], now would be the time to setup such a institution.

Re:From TFA:

[Anne Thwacks]

You mean like they do for spammers?

Re:From TFA:

[PopeRatzo]

Your ideas are intriguing to me and I wish to subscribe to your newsletter...

You couldn't afford the subscription fee.

If you insist, I'll let my credit department process your application, but don't get your hopes up.

Re:From TFA:

[Anonymous Coward]

But then you have to worry about who guards the guardians?

1. I would rather pay attention to ONE source, than a thousand different ones.
2. Stop posting links to Wikipedia pages, especially when they don't have any reference sources cited. All you linked to was somebody's opinion.

Re:From TFA:

[Specter]

Google/Android's problem only gets worse the more popular Android becomes. Android is already a more appealing target to hack because of it's lax controls compared to Apple. When it dominates in market share (and I don't doubt it will) then it becomes an even more attractive target.

Android: Everything You Hate About Your PC In The Palm Of Your Hand!

Re:From TFA:

[PopeRatzo]

Android: Everything You Hate About Your PC In The Palm Of Your Hand!

And everything you love.

I'll take my chances, thanks.

Selfish idea

[SuperKendall]

Why couldn't a group of Android developers get together and set up a reviewing panel that will certify apps as threat-free? Before I download an app, I can see if the reviewing panel lists it or not and have that one extra data point with which to make my decision. If the panel's work is done in a transparent manner, people would trust it and they would have a measure of safety without having to be walled inside.

The only people that would protect are the people who don't need protection.

You are trying to solve the problem of how to make life easier for YOU, not the average user who would have no clue the panel existed and would not care if they did.

Any kind of "seal of approval" faces the same issue, that most people would not care and continue to run the other stuff anyway.

A better approach is Amazons, to make a market of wholly vetted apps where probably Amazon does more verification of who a publisher is. Then non-technical users can stick to that market.

Re:Selfish idea

[node 3]

You are trying to solve the problem of how to make life easier for YOU, not the average user who would have no clue the panel existed and would not care if they did.

Actually, he's trying to solve the problem in a way that doesn't involve admitting Apple's model works better than Google's.

Re:Selfish idea

[PopeRatzo]

You are trying to solve the problem of how to make life easier for YOU

Well, that's true.

A better approach is Amazons, to make a market of wholly vetted apps where probably Amazon does more verification of who a publisher is. Then non-technical users can stick to that market.

I agree. But the key here is choice. I can shop at the store that can be trusted, or I can shop in the back alleys if Scumabad. But either way, I can make a choice.

That's superior to having one company make all the choices for me.

And still, there will be reviewers who will be trusted, or not, and it will continue to work the way buying applications has always worked in the free world.

Re:Selfish idea

[macs4all]

A better approach is Amazons, to make a market of wholly vetted apps where probably Amazon does more verification of who a publisher is. Then non-technical users can stick to that market.

Hmm. Sounds suspiciously like a Walled Garden that keeps getting bashed around here...

Except with a fraction of the available apps.

Re:Selfish idea

[SuperKendall]

That's superior to having one company make all the choices for me.

Actually it's not, unless Amazon is the default store.

Currently the iPhone approach is far more secure while still allowing complete freedom for more technical users.

Additionally the iPhone is actually much easier to hack in the traditional sense of the word, as it's very easy for programmers to make slight programmatic modifications to existing apps rather than having to create whole apps from scratch.

Re:Selfish idea

[ekhben]

I don't believe Apple's store is any less vulnerable to malware than the Android store.

The system architecture is a lot less permissive in iOS than Android, though, and that limits the damage that a misbehaved app can do - at the obvious cost of limiting the options for well behaved apps.

Re:Selfish idea

[node 3]

The two are intricately related. And, regardless of how you look at it, Apple's model has been shown time and again to be safer for the end user than Google's.

Re:Selfish idea

[SuperKendall]

I don't believe Apple's store is any less vulnerable to malware than the Android store.

It is less vulnerable because Apple does actual reviews. They will not find everything but they will find SOME things.

The system architecture is a lot less permissive in iOS than Android, though, and that limits the damage that a misbehaved app can do

That is another layer that indeed really helps things. The key to a secure system is defense in depth, many overlapping layers which attackers have to pass. Such a system is inherently better than even the strongest wall standing alone.

But for defense in depth to work you need many layers.

It may somewhat limit the options for well-behaved apps, but not for the things most apps need to do.

Re:Selfish idea

[ekhben]

It is less vulnerable because Apple does actual reviews. They will not find everything but they will find SOME things.

Yes, true - they'll trivially find blatant stuff, and probably some slightly less blatant stuff, but not stuff that goes to pains to hide from the review process specifically; all of which is more stuff than is caught with no review at all!

Re:Selfish idea

[PopeRatzo]

Currently the iPhone approach is far more secure while still allowing complete freedom for more technical users.

"Complete freedom"? Am I free to download an app that Apple hasn't approved and install it on my iPhone without jailbreaking it? If someone publishes a mod to iOS, am I "completely free" to install it without jailbreaking?

Am I free not to install every upgrade and continue to install apps? I'm not sure what you mean by "complete freedom for more technical users", but I guess the standard I am using is my own PC, or even my own Mac Pro. I think your standard for "complete freedom" is way too low.

Here's a good one

[Anonymous Coward]

I have a T-mobile MyTouch, and I can't access the page linked in the article,
twice it's just crashed my browser and taken me to the main screen.
It's the only link that has ever done it, me thinks it survival mode for
some application :)

False, There Is Another

[SuperKendall]

The complaint is that its the only store you are allowed to use.

Well then there are no complaints to be had because the technical people that actually want alternate stores, can jailbreak and use Cydia.

Android people don't like to acknowledge this is possible because as you say that's the only argument they have.

Re:False, There Is Another

[vux984]

Well then there are no complaints to be had because the technical people that actually want alternate stores, can jailbreak and use Cydia.

What about non-technical people who want alternate stores?

Why should people have to jailbreak their phone?

Why should jailbreaking be a violation of the EULA?

Why should we have to put up with Apple imposing any barriers whatsoever to using a non-Apple store?

As I see it, there are still lots of complaints about the status quo. The fact that I can hack my way to a semblance of what I want, by violating my EULA, and defeating Apple's software to get it to do what I want isn't a solution.

I want the law on my side.

Re:False, There Is Another

[pkinetics]

This always cracks me up when people make these arguments about the Apple model.

They want it open and available to everyone. But they want it secure and safe.

I want it open, safe, and secure.

If it is open, it is not safe.

If you want it secure, its not open.

So far both models have tried their choice and are failing at making EVERYONE happy. Hence the reason they target one side of the equation and make just those people happy.

As long as their is an audience, there will be complaints.

Re:False, There Is Another

[WhitetailKitten]

I think you misunderstand GP's point. Apple is actively hostile against jailbreaking (bricked device, anyone?). What GP wants is the ability to choose, and be left alone if he does jailbreak his iOS device. Shelter in the safety of Apple's curated store, or brave the Wild West without interference from King Jobs. Android does the latter (bootloader lockdowns by individual manufacturers notwithstanding), but not the former. Amazon is starting to supply the former for Android. GP is saying that Apple should consider following their example.

Re:False, There Is Another

[Duradin]

Define "actively hostile".

Is Apple actively hunting down jailbroken devices and hacking in to them to brick them or are people who have jailbroken their device updating the device without finding out if the update shouldn't be used with their jailbreak of choice?

Re:False, There Is Another

[WhitetailKitten]

Remember that the first updates after the first jailbreaks would brick peoples' iPhones. Now, that's arguably a consequence of poorly-made jailbreaks, and I'll concede that, but some people did end up with shiny paperweights, and Apple (rightfully, according to their EULA) did not do much to help them. They also try and lock down any avenues that jailbreaks use to prevent simple re-jailbreaking after an update. Perhaps "actively hostile" was not the best term, but the point is, Apple certainly could facilitate jailbreaking with ease and with little additional drain on their own resources. Instead, they do everything they can (short of becoming a malicious actor and bricking devices when they detect jailbreaks, which would be a PR armageddon for them) to restrict and prevent it with no compromise offered.

I personally choose not to be a part of Apple's annual obsolescence cycle, but if Android didn't exist I'm afraid that I would have an iPhone.

Re:False, There Is Another

[bonch]

What about non-technical people who want alternate stores?

Non-technical people don't want alternate stores. Your premise is flawed right from the start.

Re:False, There Is Another

[SuperKendall]

What about non-technical people who want alternate stores?

Who are they? Seriously?

Jailbreaking has had a pretty widespread adoption mostly because people want more customization of devices, the non-technical people don't really care about it for the alternate store as much...

But the answer to your question is there are many, many people who will jailbreak phones for you now. Go into just about any small independent phone or computer store and you can have it done.

Why should people have to jailbreak their phone?

Why should 99% of the population have to suffer through significantly greater security risks because YOU want side loading?

Why should jailbreaking be a violation of the EULA?

It's not. If you have any doubts just restore system settings before you go to have it serviced.

Why should we have to put up with Apple imposing any barriers whatsoever to using a non-Apple store?

Because the security benefits for non-technical users are HUGE.

The fact that I can hack my way to a semblance of what I want, by violating my EULA, and defeating Apple's software to get it to do what I want isn't a solution.

You can stick your head in the sand (or somewhere darker) as long as you want but it don't mean the sun ain't shining for those that choose to look.

I want the law on my side.

It is, jail breaking was declared explicitly legal. But again that's something you choose to ignore because it goes against preconceptions you refuse to let go of.

Re:False, There Is Another

[ADRA]

Does Jailbreaking void your warranty? Oh? darn. I guess you're argument is just fallacious. If I HAVE to void my warranty in order to use alternative applications on my phone then the market concept is NOT OPEN no matter how much of a bow you wrap around it. Time to take the fanboy cool aid and sit it out for a round.

Re:False, There Is Another

[node 3]

Remember that the first updates after the first jailbreaks would brick peoples' iPhones. Now, that's arguably a consequence of poorly-made jailbreaks, and I'll concede that, but some people did end up with shiny paperweights, and Apple (rightfully, according to their EULA) did not do much to help them.

Wow, yeah, that sounds so awful of them!

And the update you are talking about 'bricked' iPhones that had been unlocked, not jailbroken. The unlocks overwrote the baseband. This is not something to be undertaken lightly. A later iPhone OS update included a baseband update that fixed the so-called 'bricked' phones.

Re:False, There Is Another

[Anonymous Coward]

Screw that. You shouldn't have to jailbreak anything. This is wrong. I will only use free software and free standards complaint devices where possible. You can get mostly free computers (excluding BIOS) from the likes of thinkpenguin.com amongst other accessories like USB wifi adapters to printers and audio players. Now if we could only achieve something freer than android for the phone. Sadly freerunner, openmoko, etc. isn't likely to have a product out any time soon if ever. I did buy one used and sold it used. It wasn't functional enough for me to use and you still have the privacy implications with such phones. The ideal phone would have a one way receiver for incoming and then have a sleep mode for the sending. Until the user picks up they shouldn't need to reveal the locations. We had one way pagers. Why not one way cell phones?

Re:False, There Is Another

[WhitetailKitten]

I stand corrected (by both you and SuperKendall, who might've had problems reading the rest of my post). However, leaving aside bricked phones for whatever reason, I stand by the rest of my point. I believe users should be given the choice between the two (and hide the 'jailbroken Wild West' option where only power users are going to find it if need be) instead of this cat-and-mouse game with every update.

Re:False, There Is Another

[BasilBrush]

Does Jailbreaking void your warranty?

No.

Re:False, There Is Another

[node 3]

Your point of view about having it be more of a proper choice is valid, and fairly common around here, but it's something that very few of Apple's customers are really interested in.

The problem with ending the cat-and-mouse game is that jailbreaking deliberately breaks iOS's security model. Regardless of whether Apple is trying to address jailbreaking specifically, simply applying security fixes will have the effect of preventing jailbreaking.

The problem with making it a choice (even if with loads of scary warnings and the like) is that all it will take is *one* app of some sort coming out in this manner and users will completely ignore the warnings. This doesn't even have to be any sort of "banned" app, it can simply be some dev who doesn't want to go through the App Store.

It's legitimate to hold that, sure, the user and developer should be able to make those decisions for themselves. But it's a pandora's box. Once you allow it, you have the likely outcome of ending up with worst of both worlds. As things stand right now, users don't really give up all that much in terms of what they are interested in, and Apple gets to provide a trustworthy and reliable experience.

Re:False, There Is Another

[SuperKendall]

I admire your principals but sadly the free software community is really far behind in usability. I still use free software when I can myself, and try to further the cause of open source when I can, but practical reality dictates some deviations.

I wish you luck though in finding what you seek.

Re:False, There Is Another

[WhitetailKitten]

Okay, I like you. :D You have very valid points, and I must concede that I definitely see your point. (Unlike brother SuperKendall who seems to just want to troll.)

Re:False, There Is Another

[Anonymous Coward]

The law *is* on your side. The EULA is not.

Re:False, There Is Another

[Anonymous Coward]

Not only that, but you must root most handset manufacturer phones as is. Most never provide updates and have no plans to.

Re:False, There Is Another

[vux984]

Non-technical people don't want alternate stores. Your premise is flawed right from the start.

ROFLMAOWTFBBQ!!11

Since when do non-technical people not want, for example, porn? What planet do you live on?

Re:False, There Is Another

[vux984]

Who are they? Seriously?

People who want porn?

Developers who disagree with apple's app store pricing policies, who want to build apps that do things apple forbids...etc.

You can stick your head in the sand or somewhere darker as long as you want, but it won't make these people cease to exist, no matter how much you choose to ignore them because it goes against preconceptions you refuse to let go of... sound familiar?

Why should 99% of the population have to suffer through significantly greater security risks because YOU want side loading?

Sideloading can be turned off by default. The population that doesn't want it, won't have to be exposed to it.

Why should jailbreaking be a violation of the EULA?

Did you read the EULA? I did.

It is, jail breaking was declared explicitly legal.

I'm well aware of that. But Apple is protesting it will violate the warranty etc. There is a law the protects people who have the audacity to install a 3rd party oil filter in their car, that's what's needed here. So manufacturers are told unequivocally that consumers can do what they want, and they can't punish or threaten them for it.

Re:False, There Is Another

[SuperKendall]

People who want porn?

ALL porn sites work on the iPad, they would be insane not to support it.

Developers who disagree with apple's app store pricing policies

Well that's a huge market.

You can stick your head in the sand or somewhere darker as long as you want, but it won't make these people cease to exist,

It's your eyes that are covered with the dark matter my friend, because you refuse to realize just how much works today on an iPad.

Did you read the EULA? I did.

Did you understand the EULA? I did.

But Apple is protesting it will violate the warranty etc.

No they aren't. And even if they were it would not be legal. And even if the laws were changed to make it illegal, you simply restore the device to system settings - Apple has no way of knowing it was ever jailbroken.

So you see your concern is totally irrational, since at any level you care to examine the practical reality is that jail breaking does not affect warranty.

Re:False, There Is Another

[vux984]

ALL porn sites work on the iPad, they would be insane not to support it.

Porn sites != porn apps.

It's your eyes that are covered with the dark matter my friend, because you refuse to realize just how much works today on an iPad.

I know about as well as anyone can know what works and doesn't work on idevices. But you can keep making baseless smug claims if it makes you feel better.

Well that's a huge market.

Sarcasm backfire.

Its bigger than you want to admit. Lots of developers are in apples appstore because that's where they have to be to get any access to customers.

No they aren't.

"As weâ(TM)ve said before, the vast majority of customers do not jailbreak their iPhones as this can violate the warranty..."
  - Apple spokeswoman

What message exactly do you think they are trying to send?

Re:False, There Is Another

[SuperKendall]

Porn sites != porn apps.

Cydia has 'em.

I know about as well as anyone can know what works and doesn't work on advices

Plainly you do not. What I enjoy is the feeling of knowing I'm right BEFORE I post, because unlike you I know what the hell I'm talking about or else I don't post.

Its bigger than you want to admit.

It's far smaller than you are willing to admit. Sarcasm: Direct Hit. Attempt at Deflection: ineffectual.

As weÃ(TM)ve said before, the vast majority of customers do not jailbreak their iPhones as this can violate the warranty...

Can, not Will.

Learn to read boy, learn to read.

I'll let you have the last word as you blustery ignorant types tend to keep posting trying to get something right... I simply don't have time to correct all the misconceptions you hold.

A few quick tips to avoiding malware

[sl4shd0rk]

0) Do some research on your apps before installing
1) Stick to open source apps whenever possible
2) don't just click through like whack-a-mole when installing... read the perms!

Take the same precautions on your Android phone.

Re:A few quick tips to avoiding malware

[shutdown -p now]

Alternatively:

1) Install Amazon Appstore, and use it exclusively

Re:A few quick tips to avoiding malware

[sayfawa]

I'd like to stick to open source apps. Is there a way to tell which ones are by just looking in the marketplace, without searching on the net?

Ok, a quick search found the oblig. wiki page. Which says that no, you can't. But there are 3rd party lists of open source Android apps.

Re:A few quick tips to avoiding malware

[Anonymous Coward]

1.5) Move to the USA because the Amazon appstore only allows you download if you live there...

Re:A few quick tips to avoiding malware

[shutdown -p now]

Good point. I don't even live here for a year, and I'm already starting forget that so much stuff is "US only".

Re:A few quick tips to avoiding malware

[Anonymous Coward]

Alternatively:

1) Install Amazon Appstore, and use it exclusively

not a solution for anyone outside US.

The Android Market

[JohnG]

The Android Market in general is pretty broken because of the lack of even a rudimentary review process. The other day I was looking at the new releases in the Sports Games category and there were about 5 or 6 pirated ebooks of Harry Potter, the Twilight Series and several others. Needles to say, this is not only illegal, it's in the wrong category. This has been a problem in the market since its inception and Google still has yet to do anything about it. If they are unwilling to have someone at least look over the titles and categories that an app is placed in before allowing it on the market, in order to cut back on massive copyright and trademark violations and make browsing the store by category possible, why do we think they'll take any preemptive strike against malware? Google doesn't even give Android developers a convenient way to contact them. It seems to me that they wanted the Android Market to be a set it and forget it kinda thing. Will the negatively publicity form the malware for them to change that stance? I doubt it.

Re:The Android Market

[WhitetailKitten]

I've noticed that from the beginning. All the apps offering (IP-infringing) ringtones and soundboards, pretty much from day one, never mind pirated ebooks and so on. I think Google's strategy is kind of the Youtube/safe harbour policy: Let people decide what they want to see, take things down on complaints.

I'm not saying this is the smartest idea, because I tend to be quite wary about any app that has permissions I can't immediately determine (why does a calculator need full network access? Okay, perhaps ads, but I don't know that), but that appears to be their strategy.

Re:The Android Market

[Anonymous Coward]

because I tend to be quite wary about any app that has permissions I can't immediately determine (why does a calculator need full network access? Okay, perhaps ads, but I don't know that)

That, in and of itself, is a good reason to run something like Droidwall. I blacklist ALL apps by default, and only turn on connectivity for an app if actually needs it to perform its function.

Re:The Android Market

[shutdown -p now]

I do wonder how long it'll take for handset manufacturers to start preinstalling Amazon's market in addition to (or even instead of) Google's for all these reasons.

Re:The Android Market

[geminidomino]

Droidwall is not much of a fix, for two big reasons:

1. It's only an option if the kernel on your phone has iptables support. Not sure how prevalent that is now, but my POS Moment doesn't.

2. It only protects against 1 particular abuse. Nothing stops the malware from, say, sending out a series of SMS messages with your phone number, IMEI, and your entire contact list.

Curiously, since there's apparently an set of API functions for doing just that, that's not considered malicious behavior by google (and the kneejerk 'just don't use the app' barkers) despite the same behavior on PC being almost universally considered malicious.

Re:The Android Market

[Gaygirlie]

I heartily agree. I just ordered my very first Android device -- an Acer Iconia Tab A500 -- a few days ago, and I've been thinking that I really need to install an antivirus just because I can't trust even the official Android Market to provide me with malware-free software :/ It's really disconcerting, even to a geek. Just imagine how disconcerting it'll be to the not-technologically-savvy people if they heard how often there's malware there.

I personally think Google really, really needs to stop accepting everything and sets up an app review process. Yes, it will create a delay, and if Google doesn't hire enough competent people to do that there'll sooner or later be a big backlog on things to do, but... well, for the end-user even that is better than the risk of getting 'that something extra' with your downloads.

Re:The Android Market

[GORby_]

CyanogenMod to the rescue (on suported devices). Recent versions allow denying individual permissions to individual apps...
Say you got that nice password protected shopping list app, but you don't need it's internet sync feature and don't completely trust it in case you want to keep passwords and other sensitive data in it. You can then just disable the permissions you don't want it to have.
Some apps crash when you remove certain permissions, so YMMV.

Again, your phone has to be supported. Luckily my Milestone is (kinda).

Re:The Android Market

[geminidomino]

Not mine. :( I'm still stuck on 2.1 for that matter. I know there's a way to get to 2.2 but everytime I try to find it on SDX, there are new 2.2 roms that require that you already be on 2.2 (*facepalm*) so I'm still hunting down that missing link.

I was going to consider Cyanogen compatibility as part of my next phone decision, but they apparently buckled to Swype's little hissy fit -- Yes, I've read the thread where it was debated. The logic for refusing to ever implement such a feature was that it would piss off developers (read: the same people who are writing this spyware in the first damn place) and thus Google. They threw in, AFAIC, with the wrong side and that removed them from the running.

there is a hellacious amount of ignorance here

[Anonymous Coward]

Understand this: Allowing untrusted or unsigned code to be sideloaded and executed
is the exact same thing as gaining physical access
is the exact same thing as gaining root
is the exact same thing as being hacked
is the exact same thing as being profitable to someone malicious

Did we learn nothing from the desktop era at all? Do you understand that allowing "a separate store" on a device BY DEFINITION means allowing untrusted code a runtime, which thoroughly guarantees that it can eventually break through to a higher privilege level and do whatever it wants on the entire device?

Even having a 100%-signed and verified environment like iOS doesn't protect you completely, since malicious input can still sail in over HTTP, kick Safari's teeth in, and start working its way down the stack. But while Apple gets to focus on that, the rest of the industry is... god, I don't even know the metaphor... Google is inviting sketchy friends to come party with each user and giving them VIP passes.

We all know that once you're infected, the only way to be sure that you're not rootkitted is to reinstall everything from scratch, right? Right? So what's the process to do that on a phone that might not even have a host PC to install from?

The security stakes are much higher on a smartphone, and yet this industry won't stop screaming bloody murder until shoddy VLC builds can be one-click installed from Hungarian FTP servers. Jesus. Sometimes I think we deserve this future we're building.

Re:there is a hellacious amount of ignorance here

[Linux Ate My Dog!]

Mod parent up. Software people need to understand this: users cannot be asked to do "deep reasearch" and "understand permissions", they do not have the time, and they paid good money for their device that should simply work.

And we can say they are "noobs" or "stoopid" all we want, and do not deserve nice things, but the reality is that examining permissions is right now really user-unfriendly, and actually not possible: I can easily make a program that requires map access and being able to send a data message for the fun little location game I am selling, and there is no way even the smartest permissions-examiner now knows I have made a remotely-activated stalking device.

Users will vote with their wallets to get phones where they can simply get their stuff done and get some fun out of them without having the feeling every step could be quicksand. So as phone ecosystem manufacturer you have the choice of don't let crap happen on the phone, or watch your consumer pay your competitor for a phone where crap can't happen. And to make crap not happen, you will have to only allow safe programs on the phone. And as parent shows, this means a closed store.

Re:there is a hellacious amount of ignorance here

[WhitetailKitten]

Not that a closed store stops crap from happening, mind you. Lessens, perhaps, but not stops.

Maybe Google could require an ESRB -style disclosure on what permissions are needed for what (I say ESRB because game developers are required to submit a listing of content that may be offensive/suggestive/etc. with their application for a rating), with real penalties for screwing around. The disclosure could go with the app in the market, putting it up front in a more obvious way that, hey, this Angry Birds level unlocker app requires the ability to make phone calls for ____ reason. Yes, the malware developer could make up reasons and, if they're in, say, China, probably get away without a lawsuit or anything, it should be a red flag to even the least-savvy user. It'd help if it had a timer that prevented you from just rubber-stamping the install buttons without looking in the way that Firefox/etc. have for extension installs.

Re:there is a hellacious amount of ignorance here

[shutdown -p now]

This means that the default should be a closed store. It doesn't mean that the phone should not allow additional channels for application installation - they just shouldn't be easily discovered by casual users (e.g. it can be something like about:config in Firefox).

Re:there is a hellacious amount of ignorance here

[geminidomino]

Some of the app developers like this one recognize the mess and have started explaining the perms. Granted, they could be lying, but when compared to this supposed 'security app' not only requires every privacy-threatening permission, but, according to privacy inspector (the free version of the above app), also does things[0] like reading your phone number etc.

Android's a platform of adware, we've all known that from day 1, but somewhere along the line BonzaiBuddy-esque abuse-in-exchange-for-free crap became acceptable again.

[0] As opposed to just requesting the ability to do things: I think it reads function calls or something, I'm still waiting to hear back from xeudoxus.

Re:there is a hellacious amount of ignorance here

[WhitetailKitten]

Some of the app developers like this one recognize the mess and have started explaining the perms.

Yeah, I've noticed that, and that was my inspiration behind my suggestion of making it a mandatory policy, because I appreciate it when app devs do that. Yeah, they could be lying, but I'd prefer to at least get the explanation that "full internet access" is required for the ads rather than it just be sitting there for no apparent reason on an app that is not exactly network-centric.

opibaipastbi

[UmbraDei]

In case you're wondering, that's "Original poster is being an inconsiderate prick and should totally be ignored"
> People make typos. You do too. I'll bet you a 100 dollars, euro's or whatever currency you use on that. And with spelling correction these days valid words in a wrong context are even easier to miss...

Also, as an advance warning for possible future rants (and this may come as a shock. I suggest you find a nice and comfortable seat first before reading on):
[SPOILER]Not everyone on the internet is a native English speaker. The 'INTER-' part might be a subtle hint for that.[/SPOILER]

Re:opibaipastbi

[Anonymous Coward]

INTER has nothing to do with international, as you imply. It just means inter-network. As in, there's one network in one building, and another network in another building, and this bridges them. That's all.

Re:opibaipastbi

[NotSanguine]

[snip] People make typos. You do too. I'll bet you a 100 dollars, euro's or whatever currency you use on that. And with spelling correction these days valid words in a wrong context are even easier to miss...

[snip][SPOILER]Not everyone on the internet is a native English speaker. The 'INTER-' part might be a subtle hint for that.[/SPOILER]

According to the website on which TFA was posted:
Paul Roberts
Editor, Threatpost
Security Evangelist, Kaspersky Lab

Paul Roberts is an industry-known editor with close to a decade of experience as a technology reporter and analyst. Before joining Threatpost, Paul was a Senior Analyst covering enterprise security for The 451 Group. As a reporter and editor, he has written for leading technology publications including InfoWorld, eWeek, The IDG News Service, and TechTarget where he has focused on breaking security and enterprise-focused technology news and analysis. He has written for The Boston Globe, Salon.com and Fortune Small Business.

Mr. Roberts (taking the website at its word) is an editor of an English language website and a journalist with almost a decade of experience writing for English language publications. If he is unable to successfully proofread (or have it done for him) his work or, worse yet, doesn't know the difference between 'affect' and 'effect' then, (as I said) IMNSHO, I don't feel that his prose should be assigned much value.

Does that mean he's stupid? Maybe not. I admit that statement was rather hyperbolic. However, if you'd bothered to check (no need now, I did it for you -- you're welcome!) Mr. Roberts' Bona Fides, you'd know that your suggestion that there was an ESL component was spurious. What is more, since he's a "journalist" he should be able to use the primary language in which he is communicating correctly.

Yes. I make typos. But I'm not (not that you would know it, so I'm telling you) paid to write articles for public consumption. I can say that if I were, I'd make damn sure that what I wrote was grammatically correct, concise and cohesive.

I hope I've clarified my comments. You are, of course, free to disagree. Perhaps I am an inconsiderate prick for pointing out that I don't think much of the author of TFA. Then again, what's it to you? Is Mr. Roberts a personal friend? A family member? Please tell me why I should pay one whit of attention to someone who purports to be an expert in using the English language but is either too lazy or unskilled to do the job properly?

Android malware market

[goombah99]

Google announced today that to avoid lawsuits from apple over the app store name and to better describe the products offered, they are changing the name to the "malware market". They were immediately sued by Microsoft who claim to have copyrighted malware infected operating systems.

Behavioral firewall

[Anonymous Coward]

What we need is a firewall that keeps track of all of the communication by application and uploads stats into a server which aggregates/processes the data and looks for unusual activity.

You are a moron

[Brannon]

Thousands of engineers labored for years to build the hardware and low-level software so that you can prance about writing your Ruby code or whatever the fuck you do that makes you think that you are some sort of tech genius. Those engineers put a lot of effort into making sure that you didn't have to be a semiconductor physics expert in order to use computers and that you weren't going to accidentally set the thing on fire with the wrong set of keystrokes. Compared to those engineers and relative to their turf, you are a moron.

There is value in abstraction. There are a hundred things that you rely on everyday that required some skilled profession to baby-proof and they were happy to do it, because that's what engineers do--and they don't look down their noses at those users as though they are some sort of inferior lifeform.

Re:You are a moron

[shadowfaxcrx]

You have. . Utterly missed my point. I have no problem with layers of abstraction. (and btw the last time I coded anything was about 15 years ago, and it was in assembly, was a dismal failure, and I can't remember anything about that or any sort of programming beyond old Logo commands. Not my field). I have a problem with people using their particular abstraction and then pointing at people using a different abstraction that they obviously don't understand and howling about how dangerous it is. Android is not dangerous, even if various iPhone users don't understand how it works well enough to use it safely.

One of my pet peeves is people automatically assuming that that-which-they-do-not-understand is inherently dangerous and scary. Another pet peeve is people who decide to get into something without finding out at least the basics of how it works. There seems to be a general mood of impatience among the general population regarding technology. It's not just smart phones. Look at home theater. People routinely go out and buy a jillion dollars worth of fancy theater equipment, and they make sure it's capable of doing about a hundred different things, and then they get it home and set up, and get pissed off that they can't just push one button and have everything turn on and do exactly what they want when they want it.

As I've said elsewhere, that's fine. If they want to remain willfully ignorant about the device they dropped hundreds or thousands of dollars on, that's their call. But I'm not going to think they're Mensa material when they complain that it broke when they did something that they shouldn't have done, and that there are reams of material online, in the manual, and elsewhere telling them not to do it. And I'm going to be annoyed when literally *everything* in life is dumbed-down to cater to people who can't be bothered to read a manual. If that makes me arrogant, then so be it.

Two flaws in your argument

[Brannon]

1. There are alternatives, you can buy an Android phone.

2. If IOS devices made it easy to use another store, then non-technical users would be at more risk. They would get an email that said, "Hey try out this fun app" which would take them to the non-curated store, they would blindly click-through all warnings from the OS and voila, you've got a mobile experience every bit as toxic and unusable as the Windows PC experience--and you've just destroyed Apple's value proposition and their $100B market cap.

What it really boils down to is that most of Apple's critics (a) don't care at all about non-technical users and (b) really want Apple to fail anyway so are happy to argue for Apple to adopt flexibility that would lead to financial disaster for them. Apple fundamentally disagrees on both points so you aren't going to sway them.

But you have other options, see #1.

Re:Two flaws in your argument

[vux984]

There are alternatives, you can buy an Android phone.

Irrelevant.

. If IOS devices made it easy to use another store, then non-technical users would be at more risk.

I guess cars should come with the hood locked, and only the dealer has the keys?

They would get an email that said, "Hey try out this fun app" which would take them to the non-curated store, they would blindly click-through all warnings from the OS and voila

So the user who was happy with his safe one-store walled garden model clamors to a non-curated store through warnings and settings panels because of an email that said he could have a fun app...? I guess he wasn't as happy with what he had as you claim.

and you've just destroyed Apple's value proposition and their $100B market cap.

Really? Wow. How does the koolaid taste? Your turning purple you drank so much.

Apple fundamentally disagrees on both points so you aren't going to sway them.

Once upon a time, car manfucturers said that only they knew best and that having your oil changed away from the dealer or using a 3rd party oil filter or seat cover would destroy your car and turn it into a deathrap, bankrupt the company, and kill innocent drivers.

It was a stupid argument when they made it. And its a stupid argument now.

Jailbreaking was ruled legal, 3rd party app stores are thriving despite being driven almost underground, people still want iphones and apple hasn't collapsed yet.

Re:Two flaws in your argument

[PipsqueakOnAP133]

I guess cars should come with the hood locked, and only the dealer has the keys?

Funny you should say that, I got a story. A friend of mine left his car lights on and the battery ran out. Needed a jumpstart.
He couldn't figure out how to open the hood. Several friends tried to help him too and it took them somewhere around 15 minutes to open the hood.

Basically, cars don't need to come with the hood locked by the dealer. Whether or not you're able to open the hood yourself sets the benchmark.
(and if you think these guys are complete idiots: The car owner's a physicist. First friend to try to help is employed by Google; specialized in NetSec.)

And... iPhones don't need to come with a easy way to use another store, cuz figuring out how to jailbreak it (as opposed to running somebody else's tool) means you probably understand enough to be safe. Running somebody else's jailbreaking tool at least means you understand that stuff that goes wrong is probably caused by something you did.

Re:Two flaws in your argument

[vux984]

Several friends tried to help him too and it took them somewhere around 15 minutes to open the hood.

Basically, cars don't need to come with the hood locked by the dealer. Whether or not you're able to open the hood yourself sets the benchmark.

Lol, good story. I'll one-up you one though:

My 996 has a 'design' where the battery is under the hood, but the hood is on an electronic release.... so if the battery dies... your SOL.

Well almost... there is a way to do it manually that basically requires your car be at a service center on a lift. (ie.. the release mechanism has actually failed).

But for a mere dead battery... one can use booster cables to power the car (attaching jumper cables to a positive post in the accessible fuse box, and using the door striker as a ground point to power the car enough to pop the hood (front*)... and trunk.(rear*), so you can access the correct points to actually boost the vehicle.

I challenge anyone to "figure it out" by looking at it.

However, here's the thing. Its designed to do that, and it not a secret. The owners manual explains the process.

I'd be happy with Apple if unlocking my phone required reading the owners manual for the trick to it.

Running somebody else's jailbreaking tool at least means you understand that stuff that goes wrong is probably caused by something you did.

You know, if jailbreaking it required running a tool you downloaded from apple, while your phone was plugged into your computer, and you had to type a code displayed on the screen to complete the process... I'd be fine with that.

Its no different then the current difficulty. But its -supported- by apple, and that's important. Unlocking should be a supported action, not one that requires you subvert design and protection mechanisms.

Wrong, misinformation

[SuperKendall]

Apple is actively hostile against jailbreaking (bricked device, anyone?)

Apple has NEVER bricked a jailbroken device.

WIth the VERY FIRST iPhone, a few iPhones had issues with unlock hacks (which is not the same as jail breaking) interacting poorly with firmware updates, because they had re-written parts of the firmware...

What GP wants is the ability to choose, and be left alone if he does jailbreak his iOS device.

Which is what you get from jailbreaking.

brave the Wild West without interference from King Jobs

Unlike you 90% of the populace does not wish to be gunned down in the streets, which is the world you would have them live in against their will - because you are against the CHOICE by users to live in that walled area if they they find it safer and more pleasant.

bootloader lockdowns by individual manufacturers notwithstanding

Such hypocrisy... astounding.

Re:Wrong, misinformation

[WhitetailKitten]

Okay, so you responded to me twice correcting my statement regarding bricking. That's about the only logical thing you said. I'm going to give you the benefit of the doubt and assume you didn't follow my thread of logic instead of assuming you just didn't even read my post properly or that you're some kind of idiot.

What GP wants is the ability to choose, and be left alone if he does jailbreak his iOS device.

brave the Wild West without interference from King Jobs

Unlike you 90% of the populace does not wish to be gunned down in the streets, which is the world you would have them live in against their will - because you are against the CHOICE by users to live in that walled area if they they find it safer and more pleasant.

Uhh... no, my entire point is that users should be given the choice of EITHER an Apple-like walled garden OR the life of a jailbreaker... but that Apple (or Manufacturer X, in a broader sense) should respect the choice of people to jailbreak and make it an option. It should be hidden from the casual user (like Firefox's about:config or Android's "allow non-market packages" option), but it should be there. Please re-read that sentence and notice the 'or' separating the two clauses describing the two worlds.

bootloader lockdowns by individual manufacturers notwithstanding

Such hypocrisy... astounding.

Again, you seem to have misunderstood. I was referring to Android devices that are locked down by their manufacturer. The Android OS itself is designed to allow people to run non-market apps (the 'Wild West') via sideloading, but some manufacturers have restricted this option (and sometimes rooting altogether). THAT is what I was referring to, and I was acknowledging it because these locked-down devices contradict my statement about Android allowing you to run the apps of your choice outside the walled garden.

Re:Wrong, misinformation

[SuperKendall]

Uhh... no, my entire point is that users should be given the choice of EITHER an Apple-like walled garden OR the life of a jailbreaker...

I'm afraid unlike yourself, I cannot be as charitable, and will simply have to proclaim you an idiot outright.

That above, what you said, is exactly what you get with an iPhone. It doesn't matter if Apple provides it or not - your simply brain unable to grasp the fact, I will point out for others that what is, is what is.

I was referring to Android devices that are locked down by their manufacturer

Yes, I KNOW. WHOOSH.

I shall let others laugh at your expense as you attempt to figure things out.

Re:Wrong, misinformation

[WhitetailKitten]

No more food for you, jackass.

Re:Wrong, misinformation

[SuperKendall]

That is exactly the quality of reply I expected and confirms my analysis. I leave it to the reader to decide who is the village idiot of this argument.

I'll let you have the last response as I know mindless Apple Haters must have the last word and will keep blathering on until they get it.

Wrong, misinformation

[SuperKendall]

Remember that the first updates after the first jailbreaks would brick peoples' iPhones.

That was never the case, it was carrier unlocks only AND you could reset the phone (not actually bricked).

Plankton trojan?

[sabt-pestnu]

So I should download the Krill anti-malware suite?

Should I be watching out for Baleen?

New error code

[Anonymous Coward]

PEBMAC.

Actually no, it does not void anything

[SuperKendall]

Does Jailbreaking void your warranty?

No. Is it illegal? No. Does it cause bad breath? No.

You Apple haters are as thick as the Great Wall Of China - looking down it the long way.

Oh? darn.

Darn is right, your only argument shattered like a cheap shot glass on dollar whisky night.

Nobody is going you buy your BS argument.

[Anonymous Coward]

Are you a lawyer? How many license agreements have OK'd ? Car loan, Utilities, Mortgage, Employee agreement, Bank agreement, EULAs? How many lawyers have you called and had you explain each agreement? Oh and before calling the lawyer each time I'm sure you must have done due diligence to determine which lawyer was even capable of giving you advice. No? Then you deserve to get ripped off! Do you know the nutritional content of everything you put in your mouth? What if the label is incorrect or insufficient? Do you call a nutritionist before every bite? No? Well then you deserve to get sick ! Anyone who is an expert in his or her field can analyse your life and tell you how retarded you are. Though its obvious to most people that you're full of shit, it might be beneficial to you if you realize it too.

Re:Nobody is going you buy your BS argument.

[shadowfaxcrx]

Considering the fact that I'm in a fringe technical field, and not a programmer like everyone's been having fun assuming, your entire post misses the point entirely.

Your lawyer argument is stupid. No, I don't call a lawyer when I sign a car loan (btw a lawyer is involved in mortgages because those involve title transfers, and the title company has. . .Lawyers), but I do read the loan carefully. The people who are getting malware on their Androids aren't even going that far. They aren't reading anything. They're just slapping "OK" on the permissions screen without bothering to look at what permissions they are OKing.

I know it's awfully fun to join the anti-intelligence dogpile (anonymously - how very impressive) but if you're going to do it, at least make a good job of it. I'm not going to apologize for expecting members of society to exercise intelligence now and then. I get that this is not a popular view these days, but if you look around at the state the USA is in, perhaps it should be.

We agree on almost everything

[Brannon]

People should buy iPhones to protect themselves from themselves. Android is available if you don't want or need that protection.

The only thing we disagree about is that I think you are a dick for calling nontechnical iPhone users morons.

Re:We agree on almost everything

[shadowfaxcrx]

That's OK. I think you're a dick for continuing to ignore what I've typed over and over again - that merely using an iPhone does not make you a moron, but rather that using a non-iPhone without bothering to find out if what you're doing is safe when you're dealing with a device that probably has a great chunk of your financial data on it, makes you a moron, and that it is this type of moron who can be very well served by getting an iPhone.

So as long as we each think the other's a dick, I'd say we cancel each other out and can stop fighting each other ;)

Re:We agree on almost everything

[krizoitz]

Why should an end user be expected to be incredibly knowledge about the dangers (yes dangers) of the free Google marketplace in order to buy an Android powered phone? Clearly the marketing is not pushing out a message of "for experts only, be ware!" but "hey this is a great consumer phone for everyone!". The reality is that in order to safely and effectively use Android the end user should be at least somewhat familiar with the territory, on that we agree, However Google is not positioning the device that way, and really thats not exactly a fair thing to expect of someone who is buying a consumer level device.