Slashdot Mirror
New Android Malware Attacks Custom ROMs
drmacinyasha writes "Today Lookout disclosed a new form of Android malware found in Chinese markets which attacks third-party firmwares (ROMs). By using permissions granted to apps which are signed with the same private keys as the ROM itself, an app can update itself or install and uninstall other apps without user interaction. Most third-party ROMs use the private keys included in the Android Open Source Project, making them vulnerable to this attack. Last month's release of CyanogenMod 7.0.3 (and all subsequent builds) included an "important security fix" which a team member confirmed protects users against this vulnerability by preventing applications signed with the platform key to be installed to user or app-controlled storage."
The lesson that everyone needs to draw from this is that it's great that Android is open and allows you to do pretty much whatever you want. However if you start flashing your own ROMs and/or using markets other than the official Google one (and possibly Amazon's app store) then you better be REALLY SURE you know what you're doing and not just blindly download any random app from any random source that strikes your fancy.
Of course hopefully this isn't news to people who are already computer savy.
This Space Intentionally Left Blank
Those that do not understand how Public Key Crypto works should not use it.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I have a theory that cloud AV is the way for mobile phones. Just insert a layer before install that will check signatures of what you have, report a positive/negative if it knows the file, and upload for checking if it doesn't.
That way you'd save on batter and computing power and, lets face it, if you're installing something from the internet, it means you have it, so no harm done.
Permanent AV protection is not needed in a mobile phone, I think.
This is an Android story.
And since when does Apple not support software on 2+ year old phones? Can you name a single vulnerability for any version of iPhone which doesn't have an available Apple-supported patch?
Any single one. Dating back to the original iPhone from 4 or so years ago. Go ahead, I'll wait.
If somebody does not even wonder why a private key is called like that, he should be kept away at all times from any computer system more complex than a pocket calculator.
4chan down again?
Faster! Faster! Faster would be better!
Of the ROM-installing community, what percentage is NOT using CM 7.0.3?
Of the ROM-installing community, what percentage is NOT using CM 7.0.3?
Everyone using a custom ROM on a device that CM does not support. I'm not sure how many that is, but it includes the HTC Thunderbolt users.
Eagles may soar, but weasels don't get sucked into jet engines.
Those on devices where the CM 7.0.3 port is still very much a (buggy) work in progress, such as the LG Optimus.
A lot. I was using's Doc's Rom Kitchen as it had a lot better support for my SGS. I ended up trying a CM7 nightly for my SGS, it was alright, but the cameras were too dark to be functional, and my ability to text went out the window. Reverted to a stock ROM, and while I can receive texts, I still can't send (which is more so confusing to me than anything as I really don't text).
I'm now using the Insanity CM GalaxyS ROM (which is based on CM7, but is very stripped down and lite.. I love it). Also flashed the 2.6.35_7_Glitch Insane Edition V10 ROM for the i9000, which is freakin sweet!
... while the code for Android is GPLv2, the move of various other projects towards GPLv3 is only going to make this sort of problem worse. The 'anti-Tivoisation' clause basically demands that some authorised signing key gets distributed with any GPLv3 code that needs to be signed in order to run, and that the available signing key grants all the rights necessary for that code to function. While it is of course possible for users to completely rebuild the trust hierarchy with their own keys, very few people will be willing to do so. As a result it seems likely that any GPLv3 project will be unable to make effective use of signing as a mechanism for preventing the execution of rogue code, even if the license allows for it in theory.
If intelligent life is too complex to evolve on its own, who designed God?
Give me a phone platform with only open source apps and stop thinking that you will be rich by selling stupid nonsense apps.
*gives fellow AC Maemo*
(It's OK, Nokia wasn't using it anyway. They're too busy setting their Meego platform on fire so they can jump off it.)
Really, it's basically what you describe. We have a community open-source repository with an automated build system. Submit your Debian source package, it builds, and the deb shows up in "extras-devel"; if you like it, you (the developer) can promote it to "extras-testing", and after a community testing process (n people have to rate it as ready for promotion), it's automatically promoted out to plain "extras" which is intended for end-users.
Of course, in reality a ridiculous proportion of power-users run extras-testing or even extras-devel daily, and only pin something to an older version (and ideally file a bug, but you know that's rare) if/when something breaks.
Last year Nokia finally brought their "ovi" app-store to the N900, but it has laughably few and pitiful apps compared to the extras repo.
I have no clue if something similar will exist for the Nokia Meego device whenever they finally crap one out, but it's one of the biggest strengths of the platform IMO.
Of the ROM-installing community, what percentage is NOT using CM 7.0.3?
anyone with a samsung galaxy s/s2 phone for a start.
This seemed like a reasonable sig at the time.
You don't have "firmwares" any more than you can have "softwares" or "hardwares" or "clothings" -- no; you have two firmware sets, two pieces of software, two pieces of hardware, and two items of clothing. These are all collective nouns.
Welcome to the new world. I am still waiting for the first virus to kill my office mobile ^^
I often wonder what people mean by "ROM" when they're talking about Android distributions (because that's what they are). I've always hoped it meant something other than "read-only memory". But if Android modders get even that basic bit of computer terminology wrong, it's no surprise they don't understand public key encryption either.
But does that mean there are really no competent Android modders? I was actually expecting a bit more from that community.
until every platform, OS, - hell, everything smarter than a toaster - is rendered insecurable.
I is really a pity that Android is plagued by malware problems. There is only one way out, or use a trusted store use only an Android app search engine which offers an antivirus and malware tool.
Nightlies are exactly that. You shouldnt be using them unless you are committed to testing very beta and possibly unstable roms. The plus however, is that we get to play with all the new toys first if it works great. Otherwise we simply go back to our restore point on the prior nightly.
Foot placed squarely in mouth since 1983.
I didn't realize there were more than one. Thanks for the big list. I will have to check how many support the color nook.