Slashdot Mirror
New Android Malware Attacks Custom ROMs
drmacinyasha writes "Today Lookout disclosed a new form of Android malware found in Chinese markets which attacks third-party firmwares (ROMs). By using permissions granted to apps which are signed with the same private keys as the ROM itself, an app can update itself or install and uninstall other apps without user interaction. Most third-party ROMs use the private keys included in the Android Open Source Project, making them vulnerable to this attack. Last month's release of CyanogenMod 7.0.3 (and all subsequent builds) included an "important security fix" which a team member confirmed protects users against this vulnerability by preventing applications signed with the platform key to be installed to user or app-controlled storage."
The lesson that everyone needs to draw from this is that it's great that Android is open and allows you to do pretty much whatever you want. However if you start flashing your own ROMs and/or using markets other than the official Google one (and possibly Amazon's app store) then you better be REALLY SURE you know what you're doing and not just blindly download any random app from any random source that strikes your fancy.
Of course hopefully this isn't news to people who are already computer savy.
This Space Intentionally Left Blank
Those that do not understand how Public Key Crypto works should not use it.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
4chan down again?
Faster! Faster! Faster would be better!
Of the ROM-installing community, what percentage is NOT using CM 7.0.3?
Everyone using a custom ROM on a device that CM does not support. I'm not sure how many that is, but it includes the HTC Thunderbolt users.
Eagles may soar, but weasels don't get sucked into jet engines.
And I speak from experience because I did own an original iPhone that stopped being supported long long ago.
And the way every single major version of Mac OS stops being supported not too long after a major version goes out. Unless you buy the upgrade you're screwed.
That means 2 years support (as I said) is the norm. Compare that to the 7 years of support windows XP had and you'll get my point.
Those on devices where the CM 7.0.3 port is still very much a (buggy) work in progress, such as the LG Optimus.
A lot. I was using's Doc's Rom Kitchen as it had a lot better support for my SGS. I ended up trying a CM7 nightly for my SGS, it was alright, but the cameras were too dark to be functional, and my ability to text went out the window. Reverted to a stock ROM, and while I can receive texts, I still can't send (which is more so confusing to me than anything as I really don't text).
I'm now using the Insanity CM GalaxyS ROM (which is based on CM7, but is very stripped down and lite.. I love it). Also flashed the 2.6.35_7_Glitch Insane Edition V10 ROM for the i9000, which is freakin sweet!
... while the code for Android is GPLv2, the move of various other projects towards GPLv3 is only going to make this sort of problem worse. The 'anti-Tivoisation' clause basically demands that some authorised signing key gets distributed with any GPLv3 code that needs to be signed in order to run, and that the available signing key grants all the rights necessary for that code to function. While it is of course possible for users to completely rebuild the trust hierarchy with their own keys, very few people will be willing to do so. As a result it seems likely that any GPLv3 project will be unable to make effective use of signing as a mechanism for preventing the execution of rogue code, even if the license allows for it in theory.
If intelligent life is too complex to evolve on its own, who designed God?
That's the whole point of the original argument (that fanboys modded down)
While there is people out there that use a phone, anyone can compile the latest fixes -(or get them from someone who knows how), hence, having a very long term support.
Saying "ohh, don't install custom roms or you might get viruses" is stupid because those custom roms will give you access to the latest version on most phones when it comes out (with all the security features).
You don't depend on a company (Apple or HTC or Samsung) to get your updates. If you want them, you can do it yourself.
PS:2 years, 2.5, what's the point? It's limited support and, sometimes, crappy (if you have a 3G you know that iOS 4 kind of made it... crap - hanging a lot etc).
So, to sum up, no, ROM's aren't evil and if you still take care with the places you get apps from there is no problem whatsoever.
It is only $30 if you are careful to never miss an upgrade cycle. If you do, the cheap upgrade disks disappear from availability, and you have to call 800-i-fanboi to be told the upgrade will now set you back something like $180. Found that out the hard way after my aunt purchased an iPhone against my recommendation, then she discovered she couldn't sync it to her only computer, a PowerPC Mac.