Android Malware May Have Infected 5 Million Users

bonch writes "A massive Android malware campaign may be responsible for duping as many as 5 million users into downloading the Android.Counterclan infection from the Google Android Market. The trojan collects the user's personal information, modifies the home page, and displays unwanted advertisements. It is packaged in 13 different applications, some of which have been on the store for at least a month. Several of the malicious apps are still available on the Android Market as of 3 P.M. ET. Symantec has posted the full list of infected applications."

Comments

No risk for me

[noh8rz2]

**wipes brow** I dodged a bullet on this one. No android, no problem, amirite? Nobody has ever pwned the iPhone.

- Sent from my ruPhone.

Re:No risk for me

[Anonymous Coward]

Yeah but did you see the names of the affected apps? You would have to be a real moron to be duped by those.

Re:No risk for me

[WhitetailKitten]

This is what I came here to say. If you think that those apps are legitimate or at least only a positive, you are either very desperate, underage, or a moron of the highest order. In the case of the first, I'm sorry you don't have the brains to find actual free porn/cheesecake pics, in the case of the second you're not clever enough to ascend to the next level of porn, and in the case of the third your phone is too smart for you, please take it back.

On a slightly different topic, since I might as well go all out in insulting average non-computer-savvy people for the crime of not spending their life like pasty-faced Anonymous Cowards in front of the cool glow of a monitor in their basement, I remember an early app in the Android market that was literally a tithe calculator. I'm GUESSING this was someone's first app or otherwise a test app by someone learning to program, because I actually downloaded it a second time after an update and the interface became slightly more refined (with a background picture instead of a flat colour and so on), and I'm not particularly here to mock the author of the app so much as any target audience members that might exist.

The app had a prompt for you to enter how much your annual income was, and then a 'go' button that returned (income/10) as the amount you needed to tithe. In the event that you belong to a church that receives tithes to support it, I'm very afraid if you need a smartphone and a custom app in order to divide a number by ten. The app did exactly what it said on the can, but by FSM I hope nobody was browsing through the Android Market and went "Oh! That's exactly what I need!"

Re:No risk for me

[Anonymous Coward]

Of course, everyone has known for the past decade at least that we're at the point where the primary attack vector for malware is social engineering. It's only really on Slashdot and other Linux-cebtric sites where you still see only a half admission of that fact. It's social engineering when it affects Linux, whereas it's shitty inherently shitty security when it affects Windows,

At least we can finally stop pretending that Linux is powered by MagicalPixieDust(TM) and is immune to infection.

Re:No risk for me

[BasilBrush]

This is what I came here to say. If you think that those apps are legitimate or at least only a positive, you are either very desperate, underage, or a moron of the highest order. In the case of the first, I'm sorry you don't have the brains to find actual free porn/cheesecake pics, in the case of the second you're not clever enough to ascend to the next level of porn, and in the case of the third your phone is too smart for you, please take it back.

Ah right. It's the user's fault. The classic excuse for bad IT systems.

Re:No risk for me

[symbolset]

I'm not sure how, but you've hit the crux of it. With Windows, we expect this "blame the user" scenario because we've been trained to expect it. We were hoping for better with Android. But there are just so darned many apps now to vet.

Maybe a second level of "hey, these permissions are really loose and align with known malware. Are you really sure you want to enable this app to upload all your files and your contacts list to any random website and dial 1-900 numbers to run up your phone bill?" consent might be required.

Or maybe just triggers for additional inspection of apps based on required permissions. But that costs money, and somebody has to pay for that. Maybe a permissions cost matrix for uploading your app, to pay for the code inspection. That would encourage developers to require the minimum necessary permissions.

Re:No risk for me

[unrtst]

...because I actually downloaded it a second time after an update...

...I'm very afraid if you need a smartphone and a custom app in order to divide a number by ten....

Ok, granted you are correct, but you also downloaded it... TWICE! I haven't downloaded any of the apps mentioned, and they look like crap apps I would never pay for, but I can't claim I've never tried out some free simple thing cause I was curious, as I'm guessing was the case with you. Now, if that tithe calculator required access to your phone book, net access, phone status, location data, etc, then it's stupid to install it... but then it gets into the realm of the user being able to interpret the security warnings.

I think there's definitely something about the (perceived) walled garden aspect of app stores that raises the false sense of security. Besides, it's just some goofy little app... what harm could it do? right?

People need to know about this stuff. It's not because Android or the app store security model is being bashed, but because everyone will soon need to be just as careful picking/installing apps on their phones as they should do on a PC, and perhaps more-so.

Re:No risk for me

[anonymov]

I just really wish for a more fine-grained permissions system.

I mean:

full Internet access
Allows an application to create network sockets.

Wouldn't it be fucking nice if it only could have unchecked internet access to an explicit list of URLs and "full internet access" meant "initiated by user action"?

Same for file system and for "Read phone state and identity" - 95% of apps in the market want the same permission.

It just gets devalued, like UAC's very helpful and informative "Allow this program to make changes to your computer?" prompt (More details? Sure: "Origin: Hard drive on this computer"). With all kinds of "changes" and their frequency it's not hard to see why UAC is often turned off. WIth all kinds of "full internet access" it's not hard to see why permission page is just to click "Accept".

Re:No risk for me

[DrXym]

Yeah but did you see the names of the affected apps? You would have to be a real moron to be duped by those.

Especially when an app such as "sexy women puzzle" asks for godlike permissions to run on the phone. Of course if Google were doing their jobs they'd be catching this crap a lot sooner.

Re:No risk for me

[DrXym]

Ah right. It's the user's fault. The classic excuse for bad IT systems.

People have had it drummed into them for the last 10 years not to trust unsolicited emails, attachments, to run av software and to take other simple precautions to protect their computer and their personal data. At this stage if someone is dumb enough to click on some unsolicited attachment or dubious origin, or install some dodgy software like a game crack, or enter their SSN and credit card details because a phishing email then the consequences are entirely theirs and theirs alone. Even the best IT department is not going to protect users and many people don't even have one. And the same principle applies to smart phones, more so.

Re:No risk for me

[DrXym]

I don't think Android's permission model is very good (it should allow some actions like making calls / SMS / root to be user vetoable) but the fact it has permissions is still better than nothing. When a free "sexy women puzzle" is asking permission to make calls or send / receive SMS messages then if you have a lick of sense you won't install it.

Re:No risk for me

[symbolset]

I've had this argument on /. a thousand times. There's a reason why NetBSD isn't popular. They have a certain philosophy that security isn't something you compromise on to deliver usability or popularity. They don't implement a feature - any feature - unless it can be secured. They don't listen on ports by default. They don't auto-execute anything on mounting, and so on - because these features, while popular, compromise security. It's a religion with them. They've had some lapses but AFAIK no current NetBSD distribution has ever been proven to have a remote exploit.

And that's why NetBSD is the go-to starting point for folks who don't want to share their files with the wide Internet.

Re:No risk for me

[poetmatt]

lowest hanging fruit.

Why deal with complex, difficult scenarios when you can get an end user to give you everything you want willingly?

This article is by definition that, by being submitted by bonch (MS sockpuppet) the same day as this "malware warning" was even discovered. Watch how by tomorrow it's probably forcibly uninstalled/removed from the market/etc.
 

Re:No risk for me

[kwark]

There are apps (that if you trust them) for root users (e.g. LBE Privacy Guard) or custom roms (e.g. CM7) that enable the user to "veto" certain permissions.

Re:No risk for me

[WhitetailKitten]

In the case of the tithe calculator app, it required no permissions whatsoever, and this was early on in the Market's lifespan, before too many malware incidents had happened (though there had been at least one). My phone is now rooted with DroidWall installed, so nothing gets 3G or wifi access unless I let it through the firewall, and if it's obviously fishy, Deal & Be Billionaire! anyone, I'm not even going to let it touch my system anyways.

Yes, had the tithe calculator asked for any sort of permissions except maybe turning the vibration on for some zany reason, I would've just kept on my way.

Re:No risk for me

[AngryDeuce]

Ah right. It's the user's fault. The classic excuse for bad IT systems.

No matter how secure a system you create, users will find a way to fuck it all up. This is not a new concept.

The alternative approach, a "walled garden" has it's caveats as well. In the end it comes down to what's more important to you, being able to download and install whatever the fuck you want, or having someone playing referee before you even get the choice to protect you from yourself?

However you decide is your decision, but in my years of providing tech support, I've discovered that yeah, most people should probably be on the walled garden, but convincing them of that fact is akin to telling any full grown adult they need to be supervised like children. Most people are not so willing to hear shit like that, so we end up with a bunch of idiots downloading obvious malware that any experienced user could identify.

I wouldn't give a kid who just got his learner's permit the keys to a Bugatti Veyron. Similarly, I wouldn't advise someone that doesn't know how to make safe computing decisions to buy an android phone. But if you know what you're doing, there's just no comparison to what you can do with your handset compared to the iPhone or Windows Mobile. It would be quite hard for me to trade that in for a layer of security I do not need.

Re:No risk for me

[Anonymous Coward]

" you're holding it wrong". Sound familiar?

Re:No risk for me

[jedidiah]

This is a different problem than the usual Windows problem. The usual Windows problem is a matter of "viewing the wrong document". It's usually the sort of activity that would have previoulsy been considered absurd as a virus attack vector.

Microsoft loves to blur the boundary between programs and data and install things without a user's consent or knowledge.

The Android problem is different. It's harder because you are trying to protect the end user from their own actions, actions that need to be permitted in order for the platform to be useful. You need to do this when the user might simply ignore or disable any extra facility you might create.

Re:No risk for me

[jedidiah]

No. We should stop pretending that OS and application design choices don't matter. They can't stop everything but they can avoid the sort of nonsense that happens in Windows. When it comes to "social engineering" in Windows, the bar is simply much lower. No degree of self-delusion on yoru part will change that.

You can be smug when Android or iPhone or Linux or MacOS has the same sort of "browse this webpage get infected" problem that Windows has.

Re:No risk for me

[Anonymous Coward]

No degree of self-delusion on yoru part will change that.
You can be smug when Android or iPhone or Linux or MacOS has the same sort of "browse this webpage get infected" problem that Windows has.

http://en.wikipedia.org/wiki/Pwn2Own

Keep sticking your head in the sand and calling others self-delusional if you want.

In day 2 the iPhone 4 and Blackberry Torch 9800 were both exploited. Security researchers Charlie Miller and Dion Blazakis were able to gain access to the iPhone's address book through a vulnerability in Mobile Safari by visiting their exploit ridden webpage. The iPhone was running iOS 4.2.1, however the flaw exists in version 4.3 of the iOS.

Re:No risk for me

[josepha48]

it's almost all porn. there are better places to get porn than the android market :) I agree anyone who downloaded one of these apps must be a moron

Re:No risk for me

[BasilBrush]

People have had it drummed into them for the last 10 years not to trust unsolicited emails, attachments, to run av software and to take other simple precautions to protect their computer and their personal data.

And they've had to do it because email is a bad IT system. It's trivial to spoof, which means it's hard to systematically block those with bad intentions.

You've just echoed the point of users being blamed for bad IT systems.

Re:No risk for me

[anonymov]

Why do you need to spoof anything?

People gladly email passwords to adminlstrator@gmail.com and run the attachment to "Subj: Look at those dancing bunnies ^_^ From: Jenny <os107vwvrb@yahoo.com>" without any spoofing going on.

There's no way to stop this with any messaging system as long as registration is open and doesn't require a proof of identity.

Re:No risk for me

[BasilBrush]

"Ah right. It's the user's fault. The classic excuse for bad IT systems."
No matter how secure a system you create, users will find a way to fuck it all up. This is not a new concept.

Of course it's not a new concept. You're just restating the CLASSIC excuse for bad IT systems I just mentioned.

However you decide is your decision, but in my years of providing tech support, I've discovered that yeah, most people should probably be on the walled garden, but convincing them of that fact is akin to telling any full grown adult they need to be supervised like children.

Apple are having no difficulty selling the idea to people. Not just on iOS, but on the Mac, where the option to download from where ever is still there, people are loving the Mac App Store. People like the reassurance that apps have been vetted, and they like the idea of a one stop shop.

And no it's not just for those who don't know much about technology. I've been computing since 1977, and I spent a decade in mobile development. And I far prefer the single vetted store concept of iOS.

I wouldn't give a kid who just got his learner's permit the keys to a Bugatti Veyron.

OK, car analogies. An automatic isn't just for those who don't know how to use a stick shift. A seat belt isn't just for those who can't recognise hazards.

Re:No risk for me

[Anonymous Coward]

Yeah, that's exactly what I told my girlfriend last night.

Re:No risk for me

[BasilBrush]

Why do you need to spoof anything?

One could write a book on it. Spammers and worms spoof all sorts of headers in email. So ask yourself what they know that you don't.

There's no way to stop this with any messaging system as long as registration is open and doesn't require a proof of identity.

You're lacking in imagination. For example: You want access to the internet, you go to an ISP and you subscribe and get an account. Suppose the messaging system was tied to that account, with no spoofing possible. When you get discovered as a spammer or sending malware, that account is frozen. That would stop spammers in their tracks, as they'd have to sign up and pay for another ISP account. And users with worm infections would need to get their computers cleaned up before they get their account unfrozen.

And that's just one of the many possibilities of a vastly more secure messaging system than email.

Re:No risk for me

[BasilBrush]

I'm not sure how, but you've hit the crux of it. With Windows, we expect this "blame the user" scenario because we've been trained to expect it.

That's how. I'm a Mac developer. In that community, if users are doing things wrong, then the instinct isn't to blame the users, but to ask how the software can be better.

Re:No risk for me

[BasilBrush]

Wouldn't it be fucking nice if it only could have unchecked internet access to an explicit list of URLs and "full internet access" meant "initiated by user action"?

Can your mom differentiate between a good URL and a bad URL? If not then it's a pointless idea as a security feature for a phone.

Delegating vetting of apps behaviour to end users is a fundamentally bad idea. It's a task that requires skills and experience, and you can't assume them in a consumer product. This is stuff that should be done by professionals in the supply chain.

Re:No risk for me

[fluffy99]

I'm not sure how, but you've hit the crux of it. With Windows, we expect this "blame the user" scenario because we've been trained to expect it. We were hoping for better with Android. But there are just so darned many apps now to vet.

Maybe a second level of "hey, these permissions are really loose and align with known malware. Are you really sure you want to enable this app to upload all your files and your contacts list to any random website and dial 1-900 numbers to run up your phone bill?" consent might be required.

Or maybe just triggers for additional inspection of apps based on required permissions. But that costs money, and somebody has to pay for that. Maybe a permissions cost matrix for uploading your app, to pay for the code inspection. That would encourage developers to require the minimum necessary permissions.

I'd like to see just plain simple color coding added. The permission prompt would be red if the app was asking for permissions that include things like sending sms messages. Green would be for something that only asked for minimal or no permissions.

I like the idea of tiered costs based on permissions, but it's probably not going to be much of an obstacle for the guys that really want the permissions to do shit like hijacking your browser to point to click-through sites.

Re:No risk for me

[anonymov]

One could write a book on it. Spammers and worms spoof all sorts of headers in email. So ask yourself what they know that you don't.

You seem to have misunderstood me. I'll rephrase: "Why do you need to spoof anything to make morons do what you need?"

What difference do headers make, when a) sender uses throw-away account on legitimate mail service (or worm uses victim's mailbox and address book), b) user doesn't understand "Don't tell your password to anyone", c) user wants his motherfucking dancing bunnies and doesn't even look at sender's name?

You're lacking in imagination. For example: You want access to the internet, you go to an ISP and you subscribe and get an account.

> as long as registration is open and doesn't require a proof of identity.

You basically propose yet another variation on the Internet passport theme.

Re:No risk for me

[AngryDeuce]

Apple are having no difficulty selling the idea to people. Not just on iOS, but on the Mac, where the option to download from where ever is still there, people are loving the Mac App Store. People like the reassurance that apps have been vetted, and they like the idea of a one stop shop.

Uh, good for those people, I guess? It's still a layer of security that everyone does not need, hence why people opt out of it by choosing Android. Hell, there are millions of people that opt out by jailbreaking their iDevices, which comes with it's own set of risks. Clearly, some people prefer having a choice one way or the other, if they're willing to go to such lengths to have one...

And no it's not just for those who don't know much about technology. I've been computing since 1977, and I spent a decade in mobile development. And I far prefer the single vetted store concept of iOS.

I never said it's just for people that don't know much about technology. I said people that don't know much about technology should opt for the walled garden. I know techy people that went with the iPhone because they didn't feel like fiddling with their phone and wanted one that "just works".

I can tell that you're sensitive about people criticizing the walled garden, but it's not like it's perfect. Like I said, it comes with a loss of personal control that some people are unwilling to accept, that's an undeniable fact, unless at some point recently Apple started letting people install and run whatever the hell they want on their phone. Personally, I prefer having the ability to run whatever apps I wish on my phone regardless of whether or not it's considered "safe".

I just wish I knew what so terrified some of these more "locked down" companies about giving people the choice one way or the other with their own device. That's the biggest thing that would irritate me, the fact that after paying hundreds of dollars for a piece of hardware it still has the nerve to tell me I can't do something arbitrary with it. I can take a hammer to it if I want, but I can't run an unapproved app, even if I assume all the risks of doing so? Come on.

I run several unofficial apps on my Android phone and have never had a problem. It's not like all blocked apps are blocked for being "malware", after all, and I'm willing to take the risk.

Re:No risk for me

[anonymov]

Can your mom differentiate between a good URL and a bad URL?

She can. Why shouldn't she? It's not like there are no bad URLs outside apps. It should be as much common sense as knowledge of mail frauds and con tricks.

Delegating vetting of apps behaviour to end users is a fundamentally bad idea. It's a task that requires skills and experience, and you can't assume them in a consumer product. This is stuff that should be done by professionals in the supply chain.

May be, though I, like many others, prefer choice. But why does that invalidate a need for better permission system? AFAIK, iOS basically permits applications to do whatever they want with internet, relying on vetting to weed out abuse - and it's not guaranteed to work. There already was a handful of examples, like Dolphin browser quietly sending every URL you visit to their server "to check compatibility with Webzine"

You seem to be opposed to it only on "iOS approach good, Android approach bad" basis. I don't see anything wrong with requiring basic knowledge from smartphone users. Is "Don't install games that want to send paid messages on your phone" so much harder than "Don't put metallic tableware in the microwave"?

Re:No risk for me

[Karlb]

OK, car analogies. An automatic isn't just for those who don't know how to use a stick shift. A seat belt isn't just for those who can't recognise hazards.

Yeah, your post was good right up to here. Even if you are adept at spotting hazards would you trust others to ? The Malware door swings many ways.

Re:No risk for me

[BasilBrush]

I'll rephrase: "Why do you need to spoof anything to make morons do what you need?"

And whilst you have the arrogance to call people who's specialism isn't IT "morons", you're never going to be able to see that the problem is your own inability to see past current solutions.

What difference do headers make, when a) sender uses throw-away account on legitimate mail service (or worm uses victim's mailbox and address book), b) user doesn't understand "Don't tell your password to anyone", c) user wants his motherfucking dancing bunnies and doesn't even look at sender's name?

What I proposed doesn't have throw-away accounts. And because abusers can't spoof, their account is quickly blocked from his early abuses, and few people ever get the password troll or dancing bunnies offer.

> as long as registration is open and doesn't require a proof of identity.
You basically propose yet another variation on the Internet passport theme.

You're the one that put the arbitrary requirement of open registration and lack of proof of identity in there. Whilst there is a need for anonymous services for whistleblowers and so forth, it doesn't have to be the same system the rest of us use for day to day messaging,

Re:No risk for me

[anonymov]

And whilst you have the arrogance to call people who's specialism isn't IT "morons", you're never going to be able to see that the problem is your own inability to see past current solutions.

Why the fuck do you need to be an IT specialist to refrain from clicking dancing_bunnies.exe or sending passwords?

Do you need to be a security pro to refrain from giving keys to your house to random strangers? Do you need to be an automechanic to refrain from crossing the street on red light? Do you need to be an electrician to refrain from shoving a hairpin in the outlet?

It's a new technology entering everyday life and people has to learn the rules, just like they did with electricity a century ago.

You're the one that put the arbitrary requirement of open registration and lack of proof of identity in there

And you're the one that put the arbitrary requirement of "one man - one account". Making everyone go naked because someone might have a weapon under clothes is not a rational solution and replacing all forks with spoons because someone might stick it in his eye is not a rational solution. Trading liberty for security, yada, yada, yada.

Re:No risk for me

[BasilBrush]

Trading liberty for security, yada, yada, yada.

Ah, you're a libertarian. You'll probably grow out of it.

Re:No risk for me

[anonymov]

Oh my, ran out of arguments so fast? :( Well, good day to you too.

P.S.: "Ah, you're a libertarian." - nope. Try some better ad hominems next time.

Re:No risk for me

[Anonymous Coward]

You're just like a little kid. Blustering and attacking everything you don't agree with.

Re:No risk for me

[DrXym]

What I proposed doesn't have throw-away accounts. And because abusers can't spoof, their account is quickly blocked from his early abuses, and few people ever get the password troll or dancing bunnies offer.

Except spammers and phishers will still spoof because there are corrupt ISPs and corrupt people who work for ISPs who'd generate accounts, and lots of people who'd willingly be paid to sign up for accounts to be used by spammers, and lots of people who'd unwittingly be signed up by spammers via botnets, trojans etc

So your measures wouldn't work but they'd certainly have a massive chilling effect on free expression on the internet. Lots of people appreciate being able to separate their real life from their online life yet all that would be toast. I have multiple email accounts myself not because I engage in phishing / spamming but because I want to be able to voice my opinion without any incursions on my real life.

Re:No risk for me

[Anonymous Coward]

Mac developer

LOL!

Re:No risk for me

[BasilBrush]

Except spammers and phishers will still spoof because there are corrupt ISPs and corrupt people who work for ISPs who'd generate accounts, and lots of people who'd willingly be paid to sign up for accounts to be used by spammers, and lots of people who'd unwittingly be signed up by spammers via botnets, trojans etc

When messages are not possible to spoof they are traceable, and all these things are then policeable.

So your measures wouldn't work but they'd certainly have a massive chilling effect on free expression on the internet. Lots of people appreciate being able to separate their real life from their online life yet all that would be toast.

Not at all. Just because email could replaced with something better that is traceable doesn't mean forums and blogs disappear. Nor does it mean that other anonymous message systems can't exist for the minority that need that.

It just means that the majority of wanted email traffic, which is legitimate messages and attachments, from people and companies known to each other, isn't littered with spam, malware and fishing attempts.

There is no down side to this. It's just difficult to make it happen because of the network effect. (Until the vast majority of ISPs and users use it, it doesn't have value as the primary messaging system.)

Re:No risk for me

[Jane Q. Public]

I encourage you to challenge him on his BS. When actually challenged, he shuts up (because he never seems to actually be able to back up his statements with logic or facts). And that is a relief for us all. :o)

Re:No risk for me

[DrXym]

When messages are not possible to spoof they are traceable, and all these things are then policeable.

As I said there are would be plenty of holes in such a system so it wouldn't be perfect. Emails will be forged, stolen, and hacked. Phishers use bots to mass mail their outgoing spam. It would be but a tiny extra step to use it for their incoming responses too - pick a handful of users from their massive botnet to act as daily receivers and that's that. One might also look at "traceable" systems like moneygrams, or electronic bank wires to see they are no remedy against fraud at all.

Your imagined email system is impossible to implement.

Not at all. Just because email could replaced with something better that is traceable doesn't mean forums and blogs disappear. Nor does it mean that other anonymous message systems can't exist for the minority that need that.

Er yes it would. Obviously.

Forums and blogs are hacked all the time. So all I need do is hack a forum or pay someone to and I have a complete, unique, personally identifiable email to each member. Perhaps I could print it out for all to see or just engage in a spot of extortion or blackmail as easily. Also, because forums / blogs were guaranteed to be associated personally identifiable email, it would be so much more attractive to subpoena a blog / forum which is a financial and administrative burden most operators could do without.

Might not matter much if this was a couple of people talking shit a World of Warcraft forum. It might matter a huge deal if it's a forum dealing with rape, incest, criminal / drug rehabilitation, malpractice, corporate oversite, sexuality, whistle blowing, politics, religion or anything else people might talk about in anonymity but not in a personally identifiable way.

There is no down side to this. It's just difficult to make it happen because of the network effect. (Until the vast majority of ISPs and users use it, it doesn't have value as the primary messaging system.)

Except there is massive downsides. If certfied emails were straightforward and desirable to implement then all the big names would have done it. The fact is it is neither.

Re:No risk for me

[somersault]

NetBSD isn't popular because it uses the same security philosophy as the very popular Apple app store?

I think there just might be one or two other tiny factors involved there that you're skipping over.. one being that the popularity of the iPhone has nothing to do with security.

Opps...

[frnic]

n/t

bbbbbbbbbbut

[bhcompy]

bbbbbbbbbbbbbbbbut Linux is secure!

Those Counter-Strike "Clones"

[gman003]

I've always thought it was odd that those games that literally copied Counter-Strike were allowed on the Google Market.

I know, you're about to say "copying gameplay, while unethical, is completely legal". Problem is, they didn't copy the gameplay - they're boring rail shooters. The copied stuff is the art - the textures, models, even some of the maps. And that's blatant copyright infringement. It's obvious even from the previews, if you've played the game enough. And since, at one point, people playing cs_italy were responsible for more bandwidth usage than actual people in Italy, I'm pretty sure I'm not the first to notice it.

I figured Valve, being pretty savvy about this sort of thing, figured that suing them would give them too much publicity - Streisand Effect and all that, not worth the huge amount of publicity that anything Valve does. Now, I'm thinking that iApps7 was just ignoring the cease-and-desists, because when you're already distributing malware and committing actual, commercial copyright theft, you're probably not too afraid of lawyers.

Re:Those Counter-Strike "Clones"

[Anonymous Coward]

I've always thought it was odd that those games that literally copied Counter-Strike were allowed on the Google Market.

I know, you're about to say "copying gameplay, while unethical, is completely legal".

Apparently, it's only red double decker buses on a black and white picture that can be not made similar.

Re:Those Counter-Strike "Clones"

[anonymov]

And next logical step from playing Quake III and Counter-Strike is going to school with a gun.

Your "logical" misses actual logic.

Re:Those Counter-Strike "Clones"

[chekkerness]

I know, you're about to say "copying gameplay, while unethical, is completely legal".

Well, you're wrong. I don't find it unethical at all, so I wouldn't say anything like that.

Re:Those Counter-Strike "Clones"

[jedidiah]

It's pretty commonplace actually. You don't have to look in the Android market to find it. If you think it only happens there then you are some kind of mindless platform partisan.

You're not paying attention to what's been happening in the rest of the market for 30 years.

When do we get to raid Blizzard?

Re:Those Counter-Strike "Clones"

[Anonymous Coward]

And since, at one point, people playing cs_italy were responsible for more bandwidth usage than actual people in Italy, I'm pretty sure I'm not the first to notice it.

This is funny by itself. But if that were actually true, as a 10 year cs veteran, I find this quite humorous.

Re:Those Counter-Strike "Clones"

[Anonymous Coward]

I've always thought it was odd that those games that literally copied Counter-Strike were allowed on the Google Market.

I know, you're about to say "copying gameplay, while unethical, is completely legal". Problem is, they didn't copy the gameplay - they're boring rail shooters. The copied stuff is the art - the textures, models, even some of the maps. And that's blatant copyright infringement. It's obvious even from the previews, if you've played the game enough. And since, at one point, people playing cs_italy were responsible for more bandwidth usage than actual people in Italy, I'm pretty sure I'm not the first to notice it.

I figured Valve, being pretty savvy about this sort of thing, figured that suing them would give them too much publicity - Streisand Effect and all that, not worth the huge amount of publicity that anything Valve does. Now, I'm thinking that iApps7 was just ignoring the cease-and-desists, because when you're already distributing malware and committing actual, commercial copyright theft, you're probably not too afraid of lawyers.

First of all, copying gameplay isn't unethical. It has been a really important tradition in the history of gaming. Do you really think once someone makes a solitaire game that no other developer should ever be able to make their own solitaire game? And once we had Doom, it is unethical for other people to make first person shooter games? And we shouldn't have any RPGs except for Akalabeth and the Ultima Series. Or maybe just Zork. And there shouldn't be more than one company developing games for the Wii, right? Because like 90% of them have the same gameplay. And kinect games? Copying game play is the best thing for the gaming industry ever.

Re:Those Counter-Strike "Clones"

[chekkerness]

It's pretty commonplace actually. You don't have to look in the Android market to find it. If you think it only happens there then you are some kind of mindless platform partisan.

What? No, I meant that he's wrong about assuming that I'd say that copying gameplay is unethical.

Re:Those Counter-Strike "Clones"

[Anonymous Coward]

And that's blatant copyright infringement.

What the fuck?? Has this become the media Mafia forums now?
It is plagiarism! Something completely different. It is not cool for attribution reasons. Not for money reasons, since you can't sell (or own, or steal) information anyway. (That's why it says "license", just by the way.)

There is no such thing as a copy"right". Because there is no such thing as controlling who copies what. Try it... good luck with that. That means that there is no such thing as "intellectual property". (Why do I even have to mention that? Didn't we all here study the physics of information space, and how they differ form matter/energy?)

GTFO my planet, or I'll come for you, you criminal!

Google Needs To Get Their Ass In Gear

[rsmith-mac]

Although I seriously doubt Symantec's 5 million number is right, the fact that malware keep showing up on the market is disturbing. Actually, we're beyond disturbing, it's getting downright annoying. Google needs to do better than removing bad applications after the fact, and while this doesn't need to be a Jobsian walled garden, at a minimum Google needs to start reviewing all applications (and updates!) before posting them to make sure they're clean.

Phones are appliances, and trying to handle malware the same way we handle it on computers (which is to say, after the fact) is not going to work.

Re:Google Needs To Get Their Ass In Gear

[Nerdfest]

What they could do is provide the same sort of "reviewed application" market that Apple does, but as an option (as I believe Apple should). I see that as the best of both worlds. If you want to lower the odds of malware, use that market. If you don't mind a little risk use something else, like the current Android market.

Re:Google Needs To Get Their Ass In Gear

[Overly Critical Guy]

while this doesn't need to be a Jobsian walled garden

I say absolutely turn it into a Jobsian "walled garden" (ugh, that term). Let people with technical knowledge choose alternative markets if they want, while keeping the core, default market as safe and high-quality as possible. One of the benefits is this: Android critics often mock the platform for things like laggy scrolling or short battery life, and while it's true some of Android's fundamental graphics system slightly impedes scrolling performance, it's not as if Android is completely incapable of smooth performance, efficient battery, and so on. Apple's strict app approval process rejects apps that drain the battery or are shitty to use, and that alone contributes to the perception that iOS itself is smoother and faster.

In other words, not only would maintaining stricter quality control get rid of a lot of dangerous apps, it would also improve the overall perception of Android's performance, because only well-performing apps would get approved. And again, all the leftovers could go to alternative markets if they wanted.

Re:Google Needs To Get Their Ass In Gear

[BasilBrush]

Walled garden is the way to go.
Android users very satisfied: 47%
iPhone users very satisfied: 75%

http://www.loopinsight.com/2012/01/09/iphone-satisfaction-at-75-closest-competitor-at-47/

Re:Google Needs To Get Their Ass In Gear

[Nerdfest]

I'd also like to add that my phone is no more an appliance than my home computer. Some phones are appliances because their functionality has been reduced to that. I'm still hoping for an updated version of the N900 (or something similar) to hit the market.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

Such a clue that 5,000,000 of the are infected with malware.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

Nerds seeking a feeling of control in their lives turn to computers. They hate the idea of appliances, because the feeling of mastery over something gives them a sense of control that they lack in their daily lives. And seeing mainstream users walking around with appliances, many of the same people who alienated them in the first place, breeds resentment. That's why this "freedom" argument always comes up, because the feeling of having it taken away is like a personal attack.

But I'm afraid appliances have always been the inevitable future, just like you don't hand-crank an automobile to start it (and most people don't even manually shift gears anymore even though direct control is more fuel-efficient). And I have to say, lying in bed with a computer that does all the things I and most people in the world use them for--browsing the web, casual games, watching movies, posting on social networks, listening to music--without all the maintenance and time investment of a PC is really, really nice. It's obviously the future.

Based on sales from October through December, the tablet market already outsells the whole desktop PC market. The writing is on the wall.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

Lucky I didn't put down 100% then.

Re:Google Needs To Get Their Ass In Gear

[hey!]

Consider the difference between the following questions:

(1) Who can *you* trust?
(2) Who can *everyone* trust?

The problem with the Apple market, and with your idea too, is that it is predicated on having an answer to the second question other than "nobody".

It seems clear to me that a better solution could be built around the first question. That entails letting the consumer decide who he trusts to review and approve apps, then giving him the tools to implement that trust. That'd involve some kind of network to distribute digitally signed approvals. You wouldn't have to have different app stores. You could use any store or combination of stores you wanted. What matters is whether you can find a certification for an app from an authority you trust.

Consumers would subscribe to different authorities based on their concerns. Businesses might choose different kinds of reviewers to trust than gamers. Different functions in a business might choose different reviewers based on the kind of information they handle (e.g. whether the device running the app has sensitive or privacy related data). Evangelical Christians might choose review authorities that reject apps that promote pornography, and porn-hounds would choose authorities that reject apps promoting Christianity.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

It's a fad which will decline. I have encountered all of a handful of users with tablets and each has said basically the same thing. They are expensive toys. You really think that they will dominate in the long run? No chance in hell. Taking a look at a sliver doesn't mean much. They are like Netbooks. There will be a high point and you will see a decline.

Re:Google Needs To Get Their Ass In Gear

[Overly Critical Guy]

I have encountered all of a handful of users with tablets and each has said basically the same thing.

With a sample size like that, how could you be wrong?

For crying out loud, we're onto year three of the iPad, and it sold over 15 million last month. This is as much a "fad" as the mouse and GUI. If you don't see the inevitability of this, then frankly you are out of touch. Nobody wants to install and maintain a PC just to browse the web anymore. The same kind of streamlining already happened to gaming in the 2000s via consoles.

Re:Google Needs To Get Their Ass In Gear

[stephanruby]

Although I seriously doubt Symantec's 5 million number is right, the fact that malware keep showing up on the market is disturbing.

To be fair, this does not look like Malware at all.

For instance, I'm looking at the game called 'Balloon Game' by Ogre Games, which they say is malware. By downloading the application, you're agreeing to the fact that it can read your phone state and phone identity, you're agreeing that it can use the internet, and you're agreeing that it can install shortcuts on your home screen.

The application wants to know my unique IMEI number? or my Mac address? Whoop di doo. I really don't care about that. And yes, it has access to the internet, so it can serve me ads, send info about me, and possibly (according to Symantec) update its own code in real time.

But even if it can update its own code in real time, it can't change its permissions in real-time (it doesn't have the permissions for that), so it's still sandboxed in the permissions I gave it originally. So what's the problem here? What other "sensitive" information is it leaking out? Does this application go against anything in the Google's Market Terms of Services in any way? No, it doesn't. Only Apple has inane Terms of Services about not being able to load code dynamically from the internet.

Re:Google Needs To Get Their Ass In Gear

[rsmith-mac]

The only problem I see with that is that it doesn't do much to solve the Dancing Bunnies problem within the Market. So long as loading unsigned applications is allowed it will always be an issue, but not allowing unreviewed applications at all in the Market is a much better solution. Otherwise people are going to grab their Counter Strike knock-offs whether they're reviewed or not, because after all they're coming from Google and Google can be trusted.

Re:Google Needs To Get Their Ass In Gear

[VortexCortex]

Hold your tongue and say Apple...

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

AC writes:

Nerds seeking a feeling of control in their lives turn to computers. They hate the idea of appliances, because the feeling of mastery over something gives them a sense of control that they lack in their daily lives.

bonch writes:

I think some of the Apple hatred stems from the fact that many techies absorb themselves in computers because it gives them a feeling of control that they lack in their daily lives. Mastering a system is gratifying on many levels.

Overly Critical Guy writes:

I think the cause of reactions like yours is that some people don't have control in their lives, so they seek it in PCs, because mastering the upkeep required for a PC gives you that missing feeling of control. Having that feeling taken away from you by non-PCs threatens you on a core level, reminding you of the lack of control in your real life, so you snap back to protect it.

You don't even really try, do you?

Re:Google Needs To Get Their Ass In Gear

[Missing.Matter]

Adding a walled app garden wouldn't even begin to fix the quality control issues with Android. First you have the wild variety in smartphone quality. Sure, you get Android in more people's hands with cheaper phones, but the experience suffers and those people end up unsatisfied. Then you have the situation where a brand new phone can be released with an old OS. Looking over AT&T's Android lineup, it seems like almost 50% of their smartphones are stuck on 2.2, and will never see another upgrade. It also looks like there are currently no phones with 4.0. ICS was announced in May and launched in October. What exactly is taking so long? Every iPhone you buy today is on 5.0. Every Windows Phone you buy is on Mango. Yeah, Android is selling like crazy, but some of the phones out there offer truly awful experiences, and this will ultimately drive users to other platforms.

Re:Google Needs To Get Their Ass In Gear

[Telvin_3d]

That assumes that the average consumer can or should be able to make intelligent decisions about "who he trusts to review and approve apps". In reality it would be the malware company with the biggest marketing budget. The idea that a consumer should first spend weeks getting up to speed in the mapping or racing simulator communities before they can safely try out a couple apps is ridiculous. What you would get instead is friends recommending friends, and all that means is that every person who gets tricked they immediately recommend a few friends to download the same BS.

Because the question in question is not "who can *everyone* trust?", the question is "who can everyone trust not to serve up malware". That is a much easier question to answer. And I think "big company with a lot of resources and a large vested interest in not serving me malware" is a pretty good answer to that question.

Re:Google Needs To Get Their Ass In Gear

[Skythe]

Perhaps Symantec are flagging it as malware because it is using permissions that the app clearly does not need, and it is just some rookie developer that has permission code copied in from some other site?

Re:Google Needs To Get Their Ass In Gear

[Belial6]

Yeah, but how man iPhones are on 6.0? None? Is your problem that it takes a long time for the OS to make it to phones, or is your problem that the OS is announced too early?

Re:Google Needs To Get Their Ass In Gear

[Fireshadow]

I disagree. Here's why.

"Although I seriously doubt Symantec's 5 million number is right,...." I could see it. According to Gartner, "smartphone sales to end users reached 115 million units in the third quarter of 2011. The Android OS accounted for 52.5 percent of smartphone sales to end users in the third quarter of 2011 more than doubling its market share from the third quarter of 2010." Add in the Android phones sold prior to third quarter 2011 that are still in use.
Now we are talking about an under 10% successful infection. That doesn't grab headlines. Of course, an anti-virus vendor who happens to sell "end point protection" at $29 a year for their Pro version may have a financial incentive to make sure they are in news.

Phones are appliances, and trying to handle malware the same way we handle it on computers (which is to say, after the fact) is not going to work.

Smartphones are not appliances. Quit thinking of them as such. They are small, portable computers that meet most of the end user's needs. Hence the popularity. As their primary function is to make a phone call, perhaps the GUI does not fit into our typical "this is a computer" mindset. In the same way, VoIP phones and networks have been a target for years. For example, the Cisco 7940 has webserver built in. Again, a small computer.

Google needs to keep their market open. There's not the barriers to entry Apple has erected. I'll give you they do need to co-operate with the authorities.The key here is educating the user base. This in terms of tools (anti-virus software) as well as habits (don't go here on the web).

Links:

• Cisco Voip hacking from 2006 (?)
  http://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Endler.pdf
  Gartner
  http://www.gartner.com/it/page.jsp?id=1848514

And as I live in the U.S., land of the free, the following disclaimer applies: The above material is presented strictly for educational purposes

Re:Google Needs To Get Their Ass In Gear

[Solandri]

That's if you want to prioritize satisfaction over all else. Paradoxically reduced choice can lead to greater satisfaction even if it leads to lower productivity. While customers may be seeking to maximize satisfaction for personal use, I daresay most businesses would choose to maximize productivity, or bang for the buck. While libertarians (both the right wing and left wing types) would choose to maximize choice.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

And you're a shit stain?

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

Can the Slashdot overlords please ban this BonchOverlyCritical entity? Please? It is people like him that drive genuine posters, you know the people that might actually click those ads away. Seriously, geek.net, DO SOMETHING before your website rots away beneath you.

Re:Google Needs To Get Their Ass In Gear

[BasilBrush]

It's more than announcing early. ICS was sold on an Android phone in October. Yet still most Android phones are sold on an older version. That shit doesn't happen on iPhone.

Re:Google Needs To Get Their Ass In Gear

[BasilBrush]

That's if you want to prioritize satisfaction over all else. Paradoxically reduced choice can lead to greater satisfaction

Absolutely.

even if it leads to lower productivity.

Who says it leads to lower productivity? That's certainly not part of the message of the Paradox of Choice.

While libertarians (both the right wing and left wing types) would choose to maximize choice.

That's because they are foolish.

Re:Google Needs To Get Their Ass In Gear

[fluffy99]

To be fair, this does not look like Malware at all.

Hijacking your browser homepage, adding shortcuts to the desktop,stealing the imei and imsi (sufficient info to clone your sim card) ,copying your contacts,etc certainly counts as a trojan. Did you bother to read the symantec description?

Sure a smart user might notice the excessive permissions but the average user just hits okay and doesnt even read the list.

Re:Google Needs To Get Their Ass In Gear

[fluffy99]

Perhaps Symantec are flagging it as malware because it is using permissions that the app clearly does not need, and it is just some rookie developer that has permission code copied in from some other site?

You could try clicking the link in the article and see why. http://www.symantec.com/security_response/writeup.jsp?docid=2012-012709-4046-99&tabid=2

Or just be lazy like the rest of the slashdot heard.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

The same kind of streamlining already happened to gaming in the 2000s via consoles.

That's when even the Slashdot "can't be trendy" crowd caved. The mainstream gamer has been on consoles since at least the mid-80's.

Re:Google Needs To Get Their Ass In Gear

[stephanruby]

No, it's flagging it as "Malware" because it wants to you do the following as their solution for removing the so-called "Malware". Note how they conveniently left the simplest instructions for uninstalling the application all the way at the bottom of the page (where almost no one will see it).

Re:Google Needs To Get Their Ass In Gear

[stephanruby]

Walled garden is the way to go.
Android users very satisfied: 47%
iPhone users very satisfied: 75%

Nokia and RIM had walled garden. What's the stats with those?

Besides, even if Google copied the Apple App Store tomorrow, it would still have Android on a wide variety of devices, both low end devices and high end devices, so that rating would still be unlikely to change. The same goes for the iPhone. If Apple were to suddenly target the low end of the Market, I doubt any of the customers with the lower end devices vs. the high end would be as satisfied.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

LOL, googling "control that they lack in their daily lives" gives exactly 5 results, these two quoted anonymous GP and bonch on slashdot and a comment on reddit

You are a nerd. Nerds absorb themselves in computers because it gives them a feeling of mastery and control that they lack in their daily lives. When someone removes that control, nerds resent it because it's like a personal attack and a reminder of their life situation, especially when the product in question becomes popular among the same non-techies who alienated the nerd in the first place. (in that bonch's post quoted by parent: "it's really like an attack on the person directly, especially when the product is popular among non-techies--many of the same people who alienated that person in the first place")

He's like reciting a script, lol.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

Then get an iPhone. They're perfect for douchebags like you. I'd go so far as to say tailor made.

Re:Google Needs To Get Their Ass In Gear

[Microlith]

Walled garden is the way to go.

False. The walled garden is about trapping users and forcing them to a sole source.

What Google needs to do is start vetting and being more stringent about what gets into the store. Taking away people's ability to side load (which is what the Walled Garden is about) does nothing to further this.

Re:Google Needs To Get Their Ass In Gear

[Microlith]

That shit doesn't happen on iPhone.

Of course not. But like many things related to iOS, choice is extremely limited.

Re:Google Needs To Get Their Ass In Gear

[inglorion_on_the_net]

I've always thought that apt (apt-get, aptitude, Debian) has the right solution to this.

You get your software from a repository, and only software that is approved by the maintainers of the repository gets in.

Then, _you_ get to choose which repositories you trust.

That way, you don't have to judge the quality of all software yourself. You can leave that to the people who maintain the repositories. They will build up reputation over time, and you can go with the ones that have a good enough reputation by your standards.

A walled-garden app store like Apple's basically implements the first part of this. This is fine for a lot of people.

To also cater to those who want more freedom, without opening the flood gates, all you have to do is allow them to shop at other app stores, as well.

Re:Google Needs To Get Their Ass In Gear

[Microlith]

What is this garbage? Why is such a blatant troll getting modded up?

I'm going to defer to this AC who seems to have done a good job of connecting the dots.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

He is reading from a script, even if it only exists in his head. It's his fucked up view and he can't get off of it for some reason (insanity maybe?)

Anyways, this is just like those idiots on 4chan that reply to everyone with "well I fucked your girlfriend because I am an alpha male" la-di-freakin-dah.

Re:Google Needs To Get Their Ass In Gear

[stephanruby]

Did you bother to read the symantec description?

Yes, I did. Did you bother looking at the apps themselves on the Market after that?

The problem is that each of those app contain only a fraction of the permissions mentioned in the symantec description. And perhaps cumulatively, they may contain all the permissions mentioned, but still that's a very different picture from the one that Symantec is trying to paint.

stealing the imei and imsi (sufficient info to clone your sim card)

"stealing"? What a loaded word? It's not theft if you gave the application the permission to read the phone identity. Plus, it's a unique number that uniquely identifies your phone. It's not meant to be the secure element. It's meant to be the public one.

Re:Google Needs To Get Their Ass In Gear

[thegarbz]

Perhaps Symantec are flagging it as malware because it is using permissions that the app clearly does not need, and it is just some rookie developer that has permission code copied in from some other site?

If you think that then Disney must really be in the shit How about a game that reads your contact list?

Re:Google Needs To Get Their Ass In Gear

[dredwerker]

AC writes:

Nerds seeking a feeling of control in their lives turn to computers. They hate the idea of appliances, because the feeling of mastery over something gives them a sense of control that they lack in their daily lives.

bonch writes:

I think some of the Apple hatred stems from the fact that many techies absorb themselves in computers because it gives them a feeling of control that they lack in their daily lives. Mastering a system is gratifying on many levels.

Overly Critical Guy writes:

I think the cause of reactions like yours is that some people don't have control in their lives, so they seek it in PCs, because mastering the upkeep required for a PC gives you that missing feeling of control. Having that feeling taken away from you by non-PCs threatens you on a core level, reminding you of the lack of control in your real life, so you snap back to protect it.

You don't even really try, do you?

Thanks for that. I thought that I had heard that sentiment on Slashdot a couple of times and it was bugging me.

Re:Google Needs To Get Their Ass In Gear

[symbolset]

When netbooks came out they delivered remarkable utility with long battery life in a tiny package for low cost - using Linux and small SSD media. The netbook met a need for low-cost compromised UI with good performance. Then Microsoft convinced all the Linux netbook vendors to convert back to XP, consuming more storage (and driving the cost up) and delivering less-adequate performance. They sold more units, and lost money on every one. And then there was the crippled versions of W7 thing with even higher costs as the cost of full laptops dived below the price of netbooks. And the netbook market crashed because nobody was going to go back to the cheaper, quite awesome Linux variant when they could sell $300 laptops instead. But a funny thing happened. The price of a laptop also fell in response to this netbook threat - from $900 to under $300. Microsoft successfully killed the netbook by cutting the throats of their PC OEMs with budget laptops.

People forget that between the netbook and the tablet was a Smartbook - invented by Asus and showed briefly in 2009 at a summer trade show - and then suddenly yanked in mid show. It was a ARM/Linux platform. The very next week a very nervous looking Jerry Shen flanked by Steve Ballmer and a member of Microsoft Legal was talking up Asus W7 platforms on a stage in Taiwan. He seemed to be sending out very stressed body language - something like "help me".

So now we have ARM tablets, mostly thanks to Apple's huge margins and lack of commitment to the Windows ecosystem enabling them to innovate. But the netbook story isn't going to play out here again. The CE vendors are in this game now and Microsoft doesn't have the leverage over Samsung and HTC that they had over the PC vendors. The CE vendors can't make Apple tablets: only Apple can do that. So they're going to do the thing they CAN do, and make Android tablets as best they can. And they do. And they rock. And Google does the ecosystem thing for them, with 250M units in the field the developer need not worry about there being a market for his app if it's any good. With hundreds of thousands of apps customers need not fear the thing won't do what they want - in fact, if you've bought it for your phone you don't have to buy it again for your tablet. And some of the apps - particularly games - are quite incredible on a device with all-day battery life. And things like Kindle app of course still give you access to all the things you've bought through there too.

The new crew, the CE giants, the Samsungs and HTCs are also the ones burned on Windows Phone and buying back their stock thanks to Nokia's preferred standing - so they're not going to push for WoA. Neither are the PC OEMs, once they find out Nokia got early access and help, and they're required to include software with Nokia branding on it in their PCs.

WoA is going to try to step into this with no apps, a rejected WP7 UI and a general distrust of Microsoft, and try to make a go of it. Maybe even without multicore. They're going to have to acquire HTC to make that happen, because without something on that scale they got nuthin.

This is starting to look like the end of the beginning.

Re:Google Needs To Get Their Ass In Gear

[Noughmad]

Walled garden is the way to go.
Android users very satisfied: 47%
iPhone users very satisfied: 75%

Stockholm Syndrome. Yes, it really works.

Re:Google Needs To Get Their Ass In Gear

[LordLucless]

What they could do is provide the same sort of "reviewed application" market that Apple does, but as an option (as I believe Apple should).

The nice thing about the Android mindset, is that this can be done. Anyone who wants to can setup such a service. If there isn't such a service, then it's just a demonstration that there isn't sufficient demand for such a service - at least, there's not sufficient demand to cover the additional expense of such a marketplace. It's a very free-market approach.

Re:Google Needs To Get Their Ass In Gear

[Fri13]

They already are doing it someway. Check android market for "staff picks". And then there is "Editors picks".

Re:Google Needs To Get Their Ass In Gear

[Fri13]

And many of those complainers would learn that Android user can just switch from heavy load launcher to faster and 100% smooth without lagging, like Adw.Launcher or any other. It is perfect even with ZTE Blade what has just a ARM6 CPU and without 3D acceleration in use.

Re:Google Needs To Get Their Ass In Gear

[anonymov]

Permissions ...

receive WAP
Allows application to receive and process WAP messages. Malicious applications may monitor your messages or delete them without showing them to you. ...

read contact data
Allows an application to read all of the contact (address) data stored on your device. Malicious applications can use this to send your data to other people. ...

intercept outgoing calls
Allows application to process outgoing calls and change the number to be dialed. Malicious applications may monitor, redirect, or prevent outgoing calls. ...

modify global system settings
Allows an application to modify the system's settings data. Malicious applications can corrupt your system's configuration. ...

mount and unmount filesystems
Allows the application to mount and unmount filesystems for removable storage.

Description

ENJOY THIS SPECIAL FREE VERSION WITH NEW LEVELS NOT FOUND IN THE FULL GAME!

ENJOY THIS SPECIAL FREE VERSION WITH EXCLUSIVE NEW LEVELS NOT FOUND IN THE FULL GAME!

Whereâ(TM)s My Water is the hit app that everyone is playing. In this FREE version, enjoy more than 20 new puzzles not found in the full game.

What the fuck. Is it really Disney? Because nothing says "I'm not a fraud!" like ALL-CAPS SPECIAL FREE EXCLUSIVE VERSION coupled with I-own-your-phone permissions.

Re:Google Needs To Get Their Ass In Gear

[toriver]

There are already Marketplace-vetting services out there, perhaps they need to make themselves more visible to encourage people to use them.

Or if Google removed the Market restriction against apps that act as competing marketplaces.

Re:Google Needs To Get Their Ass In Gear

[Anne Thwacks]

With a sample size like that, how could you be wrong?

With a statistical approach like that, he is well set for a long career in politics.

Re:Google Needs To Get Their Ass In Gear

[hankwang]

"imei and imsi (sufficient info to clone your sim card)" - bzzt. For cloning, you need the secret cryptographic key as well, stored in the SIM, and which you can't even get with a smart card reader.

Re:Google Needs To Get Their Ass In Gear

[thegarbz]

It's had multimillion downloads, and is published by the same publisher as actual Disney titles. It's a worry.

Re:Google Needs To Get Their Ass In Gear

[WindBourne]

In a way, you already have that. Appbrain accepts more risk than does google. As such, once you use appbrain, you have more risk. But the idea of a market with nothing but reviewed apps is a WONDERFUL opportunity for new companies. Right now, it is either all google's market or allows all else. But, if they would allow for other markets to be accepted that are considered more secured than Google's current market, then it would be possible to have multiple companies reviewing these apps. In particular, android should be modified to allow for a more secured market than Google's current (that say google or even android.org has approved).

BTW, Google would do well to set up their reviewed apps market and compete against others.

Re:Google Needs To Get Their Ass In Gear

[jonbryce]

I think the default Android Market should be a "reviewed application" market. Android does allow you to side-load apps and use other App stores, so for that reason, it wouldn't be censorship in the same way that the Apple App Store is.

Re:Google Needs To Get Their Ass In Gear

[Gonoff]

most people don't even manually shift gears

I presume you are in the 4% then? Most people do control their gears - just not in the USA. Canadians please comment. I don't know if you have allowed the US motor industry to remove control of your cars from you as well,

Re:Google Needs To Get Their Ass In Gear

[Gonoff]

The problem is that a lot of people (most?) would find apt-get horrendous. App stores are simple way to let someone else decide for you what you want.

Even most Android users are probably quite content with one market place. You may have more than one. Most users here may well have installed things straight from an .APK file. This is not normal. We here should not take our attitudes and abilities as the norm.

Re:Google Needs To Get Their Ass In Gear

[somersault]

And I have to say, lying in bed with a computer that does all the things I and most people in the world use them for--browsing the web, casual games, watching movies, posting on social networks, listening to music--without all the maintenance and time investment of a girlfriend is really, really nice.

FTFY

Re:Google Needs To Get Their Ass In Gear

[hpoul]

why would google need to do that? simply use the amazon app store or (if you use a samsung phone) the samsung apps market.. both of which review all apps which are submitted before they can be downloaded or bought. the android market is just one (very popular) choice, but you have the option to choose a reviewed market, so go for it.. if they turn out to be much more popular, maybe google will come to the conclusion that it's worth investing into a review process..

Re:Google Needs To Get Their Ass In Gear

[Calos]

The hell? Why should that be public? It's only purpose in an app is user-level tracking and ad-serving.

Re:Google Needs To Get Their Ass In Gear

[pentadecagon]

Calling this "Malware" without further specification is somewhat exaggerated. They do what many other apps do as well: Serve ads. Collect a very limited amount of personal data. That's it. It's annoying, but certainly not damaging.

Re:Google Needs To Get Their Ass In Gear

[WhitetailKitten]

Ubuntu has had the Ubuntu Software Center for quite a while now, in Internet years, and it's a front-end to apt-get, basically, but it's entirely graphical and laid out in a logical and straightforward fashion. I didn't say it was the best implementation of a repository-style app market environment, but it sets out what it accomplishes to do fairly well for users unfamiliar or uncomfortable with package management (which sounds scary if you're unfamiliar with the terminology).

As much as I hate the closed nature of Apple's App Store and the sometimes-ridiculous approval process, I'm not a fan of the Android Market for this reason. Before I installed DroidWall on my rooted HTC Magic (aka the MyTouch 3G, the second Android device released in the US), I only installed apps that were recommended by a moderately reliable source, such as Lifehacker (not much of a fan of the rest of the Gawker network, but LH is okay) or ones where it looked particularly good and the permissions were sane. I'm a little more fearless with DroidWall when it comes to checking out an app that seems even a little sketchy, because DW's default is to block wifi/3G connections, so it only gets net access after I check it out and see if it's obviously crap or not. At any rate, if the market system worked like a collection of repositories and users were freely available (though the carriers would probably attempt to lock that down) to add trusted third-party repos to their market. Maybe not with Google Checkout payment support, perhaps, but it could be done. If Android Device X shipped without a wifi tethering app/option and the carrier's subset of the official Google Market doesn't list wifi tethering apps and yanks new ones as they're added, I'm sure someone would happily host and write if necessary a tethering app for free and slap it on a repository with a very good community reputation in next to no time, simply to fix that fascist omission.

Re:Google Needs To Get Their Ass In Gear

[jimicus]

Nobody's suggesting putting apt-get on phones; simply the concept. The obvious way to apply this on a smartphone is to allow as many app stores as you like and it's down to the user to decide which one(s) they want to use; the official one does effectively operate as a walled garden but there's no reason you can't install apps independently of the app store - or for that matter from someone else's app store.

Which does solve the malware problem while retaining freedom, but I rather suspect it gives Google such a massive advantage (they've already got an app store, all they need to do is remove the known malware, institute a review process for new apps and they're done) that nobody else would bother setting one up.

Re:Google Needs To Get Their Ass In Gear

[hey!]

That assumes that the average consumer can or should be able to make intelligent decisions about "who he trusts to review and approve apps".

Not really. It assumes *some* consumers are able to make intelligent decisions and that there is benefit to addressing their needs and costs to sweeping them in with consumers who are less savvy. By that reasoning, there should be no *Consumer Reports* and we should rely upon the Consumer Products Safety Commission to make decisions for you.

In reality it would be the malware company with the biggest marketing budget.

This is probably depends on the *kind* of malware. Take privacy intrusion. Privacy intrusion for collecting marketing data would surely be a problem, because it's legal. But it goes on anyhow, you just don't see it and it's not running on your equipment. The point of entry to the surveillance network is the retailer. Privacy intrusion for purposes of identity theft would not be a problem *for the certification system* because the "big marketing budget" provides a trail back to the perpetrators.

The idea that a consumer should first spend weeks getting up to speed in the mapping or racing simulator communities before they can safely try out a couple apps is ridiculous.

I'll ignore the various shortcomings of the scenario you propose and cut to the chase: The real issue with the system I proposed is that it cannot overcome impatience, and it conflicts with the needs of marketing, which exploits impatience. There's an app that's gone viral, but it hasn't been certified yet by anyone you've heard of. It might take weeks for the stodgy certifiers everyone uses to get around to examining the thing, during which you'll have to live without this app you feel you can't live without. So you choose to grant an exception, or worse -- to trust a dodgy certifier. In fact, the system I proposes creates a new avenue for social engineering attack in which malware authors entice consumers to trust a malicious certifier because they want their free game *right now*.

So why do I think it's a good idea? Because my standard of success is different than yours. You want a system that will protect foolish people from their choices. I want a system in which it is *possible* to make and enforce good decisions. While I think it is unfortunate that fools are exploited, I see no way of protecting them absolutely without posing unreasonable restrictions of freedom.

Because the question in question is not "who can *everyone* trust?", the question is "who can everyone trust not to serve up malware".

Well, if you can answer that, you make those agents the *default* trusted authorities. The problem I have with platform-vendor-chooses-who-everyone-has-to-trust solution is that everyone is not the same. A hospital securing its mobile devices used in health care delivery is different from a teenager who is messing with his game console. People feel differently about privacy too, and their stance may vary depending on device. That teenager might choose different universes of apps for his game console and phone.

The problem with the current system is that it relies on people being able to draw inferences about developer intent from specific permissions an app requests. How insane is that? Even an expert who understands what a permission *does* can't reliably anticipate everything it can *accomplish*, much less the *intent* of the developer in asking for it.

Re:Google Needs To Get Their Ass In Gear

[LordKronos]

I've always thought that apt (apt-get, aptitude, Debian) has the right solution to this.

You get your software from a repository, and only software that is approved by the maintainers of the repository gets in.

Then, _you_ get to choose which repositories you trust.

That way, you don't have to judge the quality of all software yourself. You can leave that to the people who maintain the repositories. They will build up reputation over time, and you can go with the ones that have a good enough reputation by your standards.

That's basically what android does. It comes configured for one repository (Google's Android Market), but you can turn on the ability to use other repositories and get your software from them. It just turns out that the default repository isn't necessarily very good at screening out bad stuff. So maybe Amazon's market will do a better job. I have no idea. However, in debian, it's entirely possible someone could just setup a repository that accepts anything submitted to them, in which case you'd have to decide whether or not you trust that repository or not, so it's not really any different.

The only significant way apt-get is any different from android is that (once you choose which repositories to trust) apt-get provides a way to "browse" all repositories simultaneously, whereas in Android you browse them one at a time.

Re:Google Needs To Get Their Ass In Gear

[rtb61]

Answer this question for a real slap from reality versus Apple marketdroid delusions. How many people own a iPad as their only computer? Now, how people own a computer and don't own an iPad? So computer sales still logically must hugely outnumber tablet sales.

Re:Google Needs To Get Their Ass In Gear

[sydneyfong]

How many people bought a new iPad instead of a new computer last Christmas?

There's nothing so illogical about people using a 3 year old computer and buying a new iPad.....

Re:Google Needs To Get Their Ass In Gear

[rtb61]

Lets try to be a little more accurate shall we. Of the 4,073 people surveyed between December 6th and December 23rd, 87% of whom were from the US (with no other details on how respondents were obtained), perhaps voluntary on a website which Apple was notified about and there is not truth to the rumour that way more that half of the respondents came from the same IP address range.

Ohh all so boring, every single Android story is a magnet for Apple marketdroid trolls, not most or politely some but every single one.

Getting a poll from Apple users sucked in by Apple marketing is like asking brain dead zombies do they like chomping on other people's brains. Once they are sucked in by the marketing they just won't admit they made a bad choice and paid twice as much as they needed too.

I thought the M$ professional trolls were bad, they have nothing on the wormy apple variety.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

iPads sold in 2011 - ~32 mln
Total iPads sold since 2010 - ~55 mln
Desktops and laptops sold in 2011 - ~350 mln

True fans don't let the facts get in the way of glowering, rubbing hands and muttering "Soon... Soon..."

Re:Google Needs To Get Their Ass In Gear

[quacking duck]

The majority in Canada are also automatic, but I and literally half my friends (mid 20s to early 40s) drive manual. The differentiator: those with family or at least married tend to have automatics.

Re:Google Needs To Get Their Ass In Gear

[BasilBrush]

Half a million apps is far from limited choice.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

There are already Marketplace-vetting services out there, perhaps they need to make themselves more visible to encourage people to use them.

This is where Google fails. They don't do a good job of putting together end to end services and products or in partnering with affiliates to do the same. I'm a big fan of both vetted apps and user choice. The problem is, if you're going to leave the devices open for users, you need to build the vetting services into the system as integral part without the user having to learn and take initiative. The Google Marketplace should have come bundled with multiple vetting services built in from day one and good defaults to prevent unvetted apps from being granted wide reaching permissions.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

Being a dick on purpose? apt-get is just a tool to get at applications in a repository. If you know anything about it, you know damn well that can be fronted up by any number of methods. Keep up the FUD, troll.

Re:Google Needs To Get Their Ass In Gear

[Abreu]

Yeah, and 76 million Tamagotchis have been sold world-wide. That doesn't make it less of a fad.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

But, can you enable an external marketplace /without/ enabling the "unknown sources"? AFAIK, my only two options are to trust google's market, and only google, or to trust everyone. Ideally, I would chose my own set of trusted sources and only allow installation from them. As it is now, it is way too easy to accidentally install a malicious apk if you have the unknown sources checked.

There doesn't even seem to be a way to check the authenticity of an .apk: you can check the signature, but there isn't any registry of who owns which key, not even Google's. That's a big fail, specially when you consider that lots of links are on third-party websites/blogs/etc.

Re:Google Needs To Get Their Ass In Gear

[Missing.Matter]

My problem is that I can buy a brand new Android phone and it's already out of date, with no guarantees that it will ever be updated. It's bad enough that I can buy an Android phone with 2.3 while 4.0 is out, but I can even buy a brand new phone with 2.2, that will probably never even be updated to 2.3. Contrast with iPhone, where even the 3GS released in 2009 is upgradable to iOS 5. How many Android phones from 2009 will support ICS? How many support Gingerbread for that matter? Also contrast with Windows Phone. Every single Windows Phone model was upgraded to the Mango release within a few months of its launch on brand new handsets.

So yes, you get more choice on the Android, but you also get lower satisfaction rates due to Googe's choice/inability to enforce standards and quality control the ecosystem. This is probably very related to Windows/OSX, where windows has a much lower satisfaction rate but much higher adoption due to Microsoft's ability to fill market segments Apple cannot.

Re:Google Needs To Get Their Ass In Gear

[Microlith]

No, not 3rd party services. Google needs to do exactly the same as Apple and have an army of people vetting software before it goes into the Google Marketplace. There's no reason they can't, while still being more permissive and flexible than Apple.

Re:Google Needs To Get Their Ass In Gear

[Stan92057]

Why don't they make a more secure OS? Thats what has been expected from MS for years. And wheres your data that makes you not believe Symantics 5 million number?

Re:Google Needs To Get Their Ass In Gear

[TheLink]

Reduction in choice may reduce the amount of eating/drinking people have to do in order to avoid decision fatigue:
http://www.nytimes.com/2011/08/21/magazine/do-you-suffer-from-decision-fatigue.html?_r=1&pagewanted=print

Re:Google Needs To Get Their Ass In Gear

[AlterEager]

Nobody's suggesting putting apt-get on phones;

Why not? It's on mine.

Re:Google Needs To Get Their Ass In Gear

[fluffy99]

Did you bother to read the symantec description?

Yes, I did. Did you bother looking at the apps themselves on the Market after that?

The problem is that each of those app contain only a fraction of the permissions mentioned in the symantec description. And perhaps cumulatively, they may contain all the permissions mentioned, but still that's a very different picture from the one that Symantec is trying to paint.

I just did, and yes the Symantec article is accurate, even though it overstates the threat. It runs at phone boot, and has permissions to monitor your calls to see who you're calling and read/change your browser bookmarks and history. There are reports that it changes your book marks to point to click-through sites. The portion of the app that does this is not part of the game, but something else added to it for the purpose of spying on the user and redirecting their browser (eg Alexa). This capability is not disclosed to the user, other than showing the permissions required. If a PC app did that, we'd call it spyware or browser hijacking. Why call it anything different when it's on an android device?

stealing the imei and imsi (sufficient info to clone your sim card)

"stealing"? What a loaded word? It's not theft if you gave the application the permission to read the phone identity. Plus, it's a unique number that uniquely identifies your phone. It's not meant to be the secure element. It's meant to be the public one.

We complain loudly about browsers which allow persistent browser cookies and flash cookies, etc. We complain that they ad companies have figured out how to track us across different sites. We complained that our Intel CPUs had serial numbers that were accessible to the OS and software to the point that even the bios makers put he option to disable this in the bios config. Why are we not complaining that Android allows access to a permanent, non-changeable, cookie?

Why does this permission even exist when it's only possible use is for user/device tracking? I guarantee that the average user doesn't realize the implications. I

Re:Google Needs To Get Their Ass In Gear

[BasilBrush]

Lets try to be a little more accurate shall we. Of the 4,073 people surveyed between December 6th and December 23rd, 87% of whom were from the US (with no other details on how respondents were obtained), perhaps voluntary on a website which Apple was notified about and there is not truth to the rumour that way more that half of the respondents came from the same IP address range.

Ah, it's not the result you would like, therefore it must have been manipulated.

However it's not just this one. Apple invariably comes at the top of consumer satisfaction surveys.

Re:Google Needs To Get Their Ass In Gear

[sjames]

I'm doing as well as anyone not in the 1% controlling my life at the moment. My Android phone is not an appliance. I have Eclipse and the SDK installed on my workstation. Thus, my phone does what I program it to do. It also has apps other people wrote, of course.

Though I have occasionally wished I had a hand crank as a backup on my car, in general, the lack of it is not a degradation of it's capabilities the way turning Android into a walled garden would be.

Also, unlike the hand crank, it costs nothing to let the user choose their own balance of safety vs. versatility.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

Reviewed applications do nothing more than provide a false sense of security. Notice the i garden store has been penetrated several times (Storm8 phone number scraping, more recent security "tech demo" that got banned).

Besides, the "malware" is nothing more than an overly aggressive ad network. It doesn't send out any more information than it already asks for in the permission screen as it doesn't hack anything.

Re:Google Needs To Get Their Ass In Gear

[stephanruby]

I just did, and yes the Symantec article is accurate, even though it overstates the threat. It runs at phone boot, and has permissions to monitor your calls to see who you're calling and read/change your browser bookmarks and history. There are reports that it changes your book marks to point to click-through sites. The portion of the app that does this is not part of the game, but something else added to it for the purpose of spying on the user and redirecting their browser (eg Alexa). This capability is not disclosed to the user, other than showing the permissions required.

Which app did you look at? Like I said, they all have different permissions listed.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

Tamagotchis cost less than 20 dollars. iPad's cost $500 starting. Big difference in the products, the target demographics, the use cases, etc. Apples and Oranges. So, yeah, we can state that iPad is not just a fad, especially given that all tablets that have been released since then has (poorly) copied it. It has become the definition of the tablet in the public conscience. Just ask your not so tech savvy friends to describe what a tablet is, and see how many basically respond "iPad".

Re:Google Needs To Get Their Ass In Gear

[Belial6]

You are saying it is bad that you CAN get a phone with 2.3? That makes no sense. If you want a phone with the latest version of Android, you can get that, just as you can get an iPhone with the latest version of iOS. The the fact that you can't get an older version of iOS isn't a problem with Android.

Re:Google Needs To Get Their Ass In Gear

[fluffy99]

Which app did you look at? Like I said, they all have different permissions listed.

I looked at several from iApps7.

Here's what Hit Counter Terrorist wants for permissions.

This application has access to the following:

coarse (network-based) location
Access coarse location sources such as the cellular network database to determine an approximate device location, where available. Malicious applications can use this to determine approximately where you are.

fine (GPS) location:
Access fine location sources such as the Global Positioning System on the device, where available. Malicious applications can use this to determine where you are, and may consume additional battery power.

full Internet access
        Allows an application to create network sockets.

read Browser's history and bookmarks
        Allows the application to read all the URLs that the Browser has visited, and all of the Browser's bookmarks.

write Browser's history and bookmarks
        Allows an application to modify the Browser's history or bookmarks stored on your device. Malicious applications can use this to erase or modify your Browser's data.

read phone state and identity
        Allows the application to access the phone features of the device. An application with this permission can determine the phone number and serial number of this phone, whether a call is active, the number that call is connected to and the like.

discover known accounts
        Allows an application to get the list of accounts known by the device.

control vibrator
        Allows the application to control the vibrator.

view network state
        Allows an application to view the state of all networks.

view Wi-Fi state
        Allows an application to view the information about the state of Wi-Fi.

System tools: automatically start at boot
        Allows an application to have itself started as soon as the system has finished booting. This can make it take longer to start the device and allow the application to slow down the overall device by always running.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

Anyone who says the iPad is a fad is completely disconnected from reality. Particularly from the business world and children.

Re:Google Needs To Get Their Ass In Gear

[fluffy99]

Just noticed that iAPPS7 apps seem to be disappearing from the Market.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

I agree. Half a million fart apps and superfluous web site clients is a lot of choice.

Re:Google Needs To Get Their Ass In Gear

[Suddenly_Dead]

IIRC, "Read your phone state and identity" is a default permission on apps targeting older versions of Android. This means there's a lot of completely legit apps that request that permission, even if they don't need or use it for anything.

And furthermore, why aren't they split? It makes sense for a game to know if I'm taking a call so it can pause itself. But why does that game also have to know who is calling me and know my IMEI?

Android's permission system is nice, but it's nowhere near perfect, and maintaining backwards compatibility means it probably won't get much better any time soon.

Re:Google Needs To Get Their Ass In Gear

[Anonymous Coward]

I hate to break this to you, but the moment you buy ANY piece of technology, especially computers and electronics, it's already out of date. Of course you can wait for the next big thing, but by the time that rolls around, the next next big thing will be coming soon. Either you can just accept that you'll never be able to be completely up to date or you can wait around forever.

On another note, ICS isn't all that much better than GB on phones. It has a few enhancements, but nothing that I'm really missing from GB.

Reaction

[Overly Critical Guy]

For years, the Windows platform was mocked relentlessly as a cesspool for malware. It's interesting to see what happens when there is a lack of quality control from the platform vendor, which turned Windows into a complete mess of contradictory interfaces (even within Microsoft's own software), convoluted configuration settings, and a third-party market devoted to cleaning up viruses and spyware. Android seriously risks going down that path, if it's not there already. There has to be more control on the part of Google.

Pushing back on that is a small contingent of techies who want to turn the smartphone into a PC. They like to cite the freedom to install anything they want, but the truth is that mainstream users wouldn't do so even if they knew how. Google needs to cater to the needs of the majority and not latch onto populist concepts sound good to tech crowds (e.g., "openness") but mean nothing to everyone else who just uses these things as tools rather than hobbies--especially when Google seems to have trouble following fundamental tenets of open source like source code access.

Those 37 million iPhone sales over December reversed the 2011 Android surge. The in-fighting among Android vendors risks more forks like Kindle Fire, customized interfaces, and abandoned phones that no longer receive updates mere months after their release. Google, turn the ship around before it's too late! The carriers won't help you.

Re:Reaction

[stephanruby]

You've all been fooled. Before you forward the Symantec scareware to all your friends, please study what the symantec announcement says a little more closely.

I've taken a look at the 'Balloon Game' by Ogre Games for instance. It's not malware. It's not doing anything that it hasn't requested in the permissions already. And even if it can update itself (as Symantec claims it can do), if you read Symantec owns report, Symantec doesn't think it can do anything (outside of the permissions it has already been granted).

The only malware here is Norton Symantec, with their fake claims about it being malware and with their super long suggested solution of removing the problem (when the last paragraph at the end of their page titled "manual removal" would remove the program far more quickly).

You may have arrived at this page either because you have been alerted by your Symantec product about this risk, or you are concerned that your device has been affected by this risk.

Install Norton Mobile Security
If you do not already have Norton Mobile Security installed on your device, please download the product from the Android marketplace.

Alternatively, you can navigate to the norton.mobi website from your device and download the product from there by completing the following steps:
Select the 90-Day free download.
Click on the Android icon to begin downloading the product.
Click on Install in order to accept the permissions that are being requested by the program.
Next, click Open and then Agree & Launch.

Note: The first time the product runs, you will be required to enter a code that is displayed on the screen in order to activate the product. Enter the provided code and press Submit.

Run a full system scan
Run a full system scan using Norton Mobile Security to remove this risk from the device. To do this, please perform the following actions:
Navigate to the Anti-Malware tab.
Click Scan Now.

Manual removal
To remove this risk manually, please perform the following actions:
Open the Google Android Menu.
Go to the Settings icon and select Applications.
Next, click Manage.
Select the application and click the Uninstall button.

Re:Reaction

[Overly Critical Guy]

It's not malware. It's not doing anything that it hasn't requested in the permissions already.

Why, who wouldn't want to give permission to change your home page, collect your personal data, and display ads?

Re:Reaction

[stephanruby]

No, I meant the home screen, not the home page. On Android, you have a home screen, which an app can add its shortcut to (assuming it's not full, if it's full, it's out of luck, and the shortcut doesn't get made). And yes, there are plenty of people who don't want ads and who don't want to be tracked.

On the Android Market, those people will usually have to pay to buy a version without the ads (and/or install a custom rom with the ads sdks disabled). There are still free apps with no tracking and no advertisements, but don't be surprised if you can't get the latest Angry Birds without ads -- if you're unwilling to pay for it either.

Re:Reaction

[Anonymous Coward]

That's a stupid question. It's called an exchange. You give up something to get what you want. You want the game, you pay for it. Either directly by handing over the cash or indirectly by watching ads which is what all 3 of the things you mention lead up to you doing. I mean, oh my fucking God, I might have to *gasp* see a targeted ad for something I might actually like. The horror I tell you!

Re:Reaction

[sjames]

Google has to vet more carefully, but doesn't need the least little bit more control.The typical consumer will just stay defaulted to market only and get 100% of the benefits you cite. Anyone who cares to will check the box and load apps from wherever they see fit.

There's no need for crazy control freakery here.

Re:May have?

[Overly Critical Guy]

From TFA:

'Symantec estimated the impact by combining the download totals -- which the Android Market shows as ranges -- of the 13 apps, arriving at a figure between 1 million on the low end and 5 million on the high. "Yes, this is the largest malware [outbreak] on the Android Market," said Haley.'

Even the most optimistic estimate is very bad.

Indirectly related, but...

[Anonymous Coward]

Apart from being somewhat annoyed about the greater difficulty of managing my smartphone when compared to my Linux boxes, I've been having a hard time selecting apps for it.

Android market is not exactly friendly (is there a way to get larger fonts?) and I'd like to have a search by permissions. Recently, I wanted a mere notepad app -- no frills, no cloud, no nothing, just the note, but there's an "excellent" notepad app which requires you to join an online service. WTF!!!

After finding 2 suitable apps, I would still need a bigger keys soft keyboard... again looking at permissions to avoid leaking unnecessary things.

No wonder guys end up getting viruses... we need better ways to control our exposure. Then again Google's business depends on offering us what we want and thus they need to know that. But am I giving my data only to Google? I wonder where my accounts and their details end up going...

Re:Indirectly related, but...

[Anonymous Coward]

Jota Text Editor is a good, free (no ads, no permissions) notepad/notepad++ like program for Android.

Re:Indirectly related, but...

[Nerdfest]

You can install apps on your phone from the browser on you Linux box using the Android Market web site.

Re:Indirectly related, but...

[WindBourne]

You miss the point.
He wants to be able to make a simple search based on permissions. That is actually a valid one. For example, the idea that Sony's remote controller for a blu-ray player requires permission to read my personal info and to read-write is a good sign that you do not want it. It is simply a data gathering app. IOW, Sony did not learn their lessons from their last attempt to do this to Windows.

The font is minor, just an annoyance. the permissions based search is ALL about security.

And he is right.

Re:Indirectly related, but...

[purpledinoz]

Root your phone and use Droid Firewall. All apps by default have no network permissions. Once it's setup, it works really well.

Re:Indirectly related, but...

[Calos]

Leaky, though, as are all apps which use root permissions. During boot, everything has access until DroidWall has loaded, been granted Su permissions, and applied rules.

It's possible to block things better, but it requires custom ROMs or modifications to the stock ROM.

Re:Indirectly related, but...

[Anonymous Coward]

Root your phone and use Droid Firewall.

Dell Streak 5, Android 2.2.2. All rooting apps have failed.

You can't just toss "root your phone" out as a solution when in many cases the phone is uncrackable ( which in any other line of computing we'd be commending ).

Re:Indirectly related, but...

[Anonymous Coward]

I use AdAway to block ads on my phone. It just uses brute force hosts file to block access. There might be a firewall program that does the same.

Re:Indirectly related, but...

[Anonymous Coward]

Thanks for that. Installed. :)

Re:Indirectly related, but...

[fluffy99]

Leaky, though, as are all apps which use root permissions. During boot, everything has access until DroidWall has loaded, been granted Su permissions, and applied rules.

It's possible to block things better, but it requires custom ROMs or modifications to the stock ROM.

True, but i also watch what has permissions to start at boot (only two trusted apps in my case) PermissionDenied is nice for reigning in permissions although many apps FC when they cant read the phone state or open a net connection (even though they shouldnt need the capability)

At least i dont have to worry that a wallpaper app is getting remote command and changing my browser bookmarks

But this paper begs to differ...

[bogaboga]

Have a read:

Here

Who cares anyway? At the end of the day, the billions Apple has in the bank will not help me pay my student and credit card debts. Neither will Android's success assist in making life easier for me.

In other words, at the end of the day, my life will not change one bit! These successes by Apple and Android companies only encourage me to save more of my dollars.

Planned obsolescence especially in the mobile gadget ecosystem only benefits huge multinational companies anyway.

Re:But this paper begs to differ...

[Anonymous Coward]

contradicts nearly ever other web survey

If by "nearly every" you mean "NetApplications'", then yes. Otherwise, not quite so "dominating".

Many Android sales are to budget buyers who don't use their phones like smartphones.

Myth and unability to understand that "iOS generates more mobile traffic" != "Android users don't browse web".

If there's a hundred of iOS devices and a hundred of Android devices in the world, and every Android owner reads 10 webpages a day, while iOS owners read 20, you'll still get 66% to 33%, though every device visits the internet.

If you look at apps usage and web share in relation to market share, you'll see they fit pretty closely. Here's a bunch of statistics. ComScore, for example, gives Android market share as 34.1% and 31.9% web share, with 43.1% and 58.5% for Apple. RIM, for comparison, is 15% of market to just 5% of web traffic.

Re:But this paper begs to differ...

[BasilBrush]

Your link - 51degrees.mobi - uses analytics build into a web app framework to count clients. Generally speaking iPhone users don't use web apps because they have such a wide variety of quality native apps. That will be why the results don't tally with market share figures or those studies counting generic web usage.

Re:But this paper begs to differ...

[Anonymous Coward]

Oops, you forgot to hit "post anonymously"

Re:But this paper begs to differ...

[Zontar The Mindless]

Maybe some of us have actual lives, and don't give a flying fuck about your preciousssss market shhhhhaaaare... Precioussss...

Re:But this paper begs to differ...

[Anonymous Coward]

Look at that. Another measurement statistic that does not separate Mobile vs. Tablet, despite this being part of the userstring. Statistics here show that iOS Tablet is about 66% of the iOS total.

Re:But this paper begs to differ...

[Anonymous Coward]

http://www.infowars.com/siri%E2%80%99s-dirty-little-secret/

"Siri’s dirty little secret is that she’s a bandwidth guzzler, the digital equivalent of a 10-miles-per-gallon Hummer H1.
To make your wish her command, Siri floods your cell network with a stream of data; her responses require a similarly large flow in return. A study published this month by Arieso, an Atlanta firm that specializes in mobile networks, found that the Siri-equipped iPhone 4S uses twice as much data as does the plain old iPhone 4 and nearly three times as much as does the iPhone 3G. "

Re:But this paper begs to differ...

[Anonymous Coward]

Generally speaking iPhone users don't use web apps because they have such a wide variety of quality native apps.

I'm sure it's nothing to do with Apple refusing to support the biggest web app platform in use.

Re:But this paper begs to differ...

[Anonymous Coward]

Overly Critical Guy, aka bonch, aka bogaboga, aka SharkLaser, is one of a set of user accounts who are used in packs to astroturf slashdot and manipulate discussions with anti-Google, pro-Apple bullshit. Mod accordingly.

bb..bbb....bbbut its running linux!

[decora]

everyone knows that you can't hack linux! linux is secure!

Re:bb..bbb....bbbut its running linux!

[Anonymous Coward]

This still doesn't say anything about security of the OS. Users downloaded an app and granted it the rights to see things it shouldn't. That's not a hack, it is yet another case of PEBKAC.

Re:bb..bbb....bbbut its running linux!

[Anonymous Coward]

That would have been funny about 1.5 million UIDs before you came here. Now it's just old.

Re:bb..bbb....bbbut its running linux!

[Anonymous Coward]

It's old and busted. Time for new, modern security model for Linux, maybe?

No?

Re:bb..bbb....bbbut its running linux!

[Anonymous Coward]

Considering that it's not a hack but a trojan wilfully installed by dumb user, the only new, modern security model to prevent it would be genocide of everyone with IQ below 120.

Re:iOS has more marketshare than Android

[Anonymous Coward]

Apple sold 37 million iPhones last quarter passing up Samsung. But... Samsung (one of many Android smartphone makers) sold close to an estimated 36.5 million phones last quarter as well.
http://www.reuters.com/article/2012/01/27/us-samsung-idUSTRE80P1KY20120127

I like how you selectively pick "IOS" devices. You are moving the goal posts and interchanging IOS, iPhone, iPad, and "smartphones" selectively and non consistently to cherry pick specific statistics that conforms to your rant. Your claim of iPhones are selling more than Android "smartphones" is 100% FALSE. More Android Smartphones were sold all of last year and every quarter then iPhones. Android does not have any thing close to IOS sales in the tablet field. SO yes.. IOS devices outsell Android devices but that has no relevance to your rant of IOS smartphones compared to the Android smartphones.

foxconn factory workers very satisfied:

[decora]

foxconn factory workers very satisfied: 100%, with no dissent! amazing.

when interviewed, every last worker expressed their deepest appreciation for their bosses, and how much they love working together for harmonious success of the company, which they love and admire deeply.

Re:foxconn factory workers very satisfied:

[Overly Critical Guy]

Foxconn is the world's largest maker of electronics components and makes products for every major computer company including Dell, HP, Microsoft, Nintendo, Samsung, and Sony. Why they're always intimately associated with Apple on tech forums is beyond me other than as anti-Apple flamebait.

Re:foxconn factory workers very satisfied:

[BasilBrush]

And your mobile phone was made where, hypocrite?

Re:foxconn factory workers very satisfied:

[Rockoon]

Foxconn is the world's largest maker of electronics components and makes products for every major computer company

...and to add some more info.. Foxconn employs just shy of 1 million workers, the equivalent of 1% of America's workforce. The flak Foxconn gets is always based on scare numbers rather than percentages.

When you employ 1 million workers, a dozen or so suicides isnt alarming at all. The news doesn't point out that 1 out of every ~70000 employees committed suicide in 2010. The news instead says 14 employees committed suicide in 2010, leaving it the the reader to try to infer what 14 means... "If 14 of my co-workers committed suicide, that would be like 5%.. terrible!"

For the record, 1 out of 70000 is an outstandingly good suicide rate. Good luck finding an industry in the United States that isnt an order of magnitude worse.

Well combine this with googles other news

[gearloos]

Well, combine this with Googles recent news of privacy policy changes and Android's shine really is fading fast. I hate Apple, not for the products, I love Macs. It's the overused domination attitude I just can't deal with. So, that said, what's left? Win phone? Omg no. Maybe RIM and Nokia still have a niche after all... Just something to consider.

Re:Well combine this with googles other news

[Overly Critical Guy]

It's the overused domination attitude I just can't deal with.

What domination attitude? If there was ever a company that was more interested in finishing last than releasing something with less than perfection in the eyes of its makers, it's Apple. For god's sake, Scott Forstall allegedly keeps a jeweler's loupe in his desk to critique their software at the pixel level.

Re:Well combine this with googles other news

[Anonymous Coward]

Windows has the best interface, Linux is the best for geeks and is free. Mac is clunky and runs on expensive hardware and they don't make any Mac-specific software so why bother.

I know it's an internet cliche to talk about but shit has to be said.

Typing this from a Mac Mini, my first and last Mac.

Re:Well combine this with googles other news

[Anonymous Coward]

From a Mac mini?

It has no key board. With your grasp of English I'm amazed you could even work out how to switch it on.

Windows has the best interface? You're clearly out of your comfort zone and are confused by something new

Re:Well combine this with googles other news

[LordLucless]

What does their attention to detail have to do with their domineering attitude?

Apple's products are all "our way or the highway", and use lock-in to try and keep people in their eco-system. It's stuff like that that the OP was complaining about, not the quality of their products.

Re:Well combine this with googles other news

[jo_ham]

What lock in?

Honestly, this comes up a lot and I have to wonder. Your contacts, calendars, email, files, music etc are all in formats that you can easily move to other platforms if you want to leave.

The only things you can't take with you are movies from the iTunes store (DRM) and apps (since they are specific to the OS, like most apps on other OSes).

Re:Well combine this with googles other news

[Anonymous Coward]

Hint: best != most polished. Sure you see the polish in the MacOS UI, but despite all the layers of shiny paint there's always that whiff of the Linux rot coming from its rotten core.

Re:Well combine this with googles other news

[hairyfish]

So, that said, what's left? Win phone? Omg no.

As much as Windows gets ridiculed in here you have to at least admit that they have a fantastic opportunity right now. There's a growing smart phone user base who are sick of Apple, Nokia, RIM and Android who I think would be ready to jump to MS, should they produce a half decent product.

Re:Well combine this with googles other news

[Rexdude]

Nokia used to be an option till February last year.

Re:Well combine this with googles other news

[Anonymous Coward]

To be honest, Windows 7 does currently have the nicest looking, most stable and fastest UI out of all operating systems. A few Linux distros are getting there, but there is still a level of clunkiness. Mac OS just looks like a Fisher-Price "my first computer" UI, it's slow and crashes often.

Re:iOS has more marketshare than Android

[Anonymous Coward]

Samsung (one of many Android smartphone makers) sold close to an estimated 36.5 million phones last quarter as well.

Phones != Android

In other words, of 36.5 million phones does not mean those are all android phones let alone smart phones.

WGA will save us!

[Anonymous Coward]

Normally I would just chalk this up to anti-Android FUD, but since it comes from Symantec--a trusted name in computer security--I have no reservations about the seriousness of the threat. Since I hate apple hipsters looks like it's back to WGA for me! Microsoft is going to bring back the Zune in phone form any day now... you'll see. Go ahead and laugh but in the end I'll be the one saying I told you so.

Re:iOS has more marketshare than Android

[Anonymous Coward]

Read the article again

Samsung didn't give its own sales volume data, but research firm Strategy Analytics put sales at 36.5 million smartphones in October-December, with 3rd-ranked Nokia on 19.6 million. Smartphones account for around 40 percent of all Samsung's handset shipments.

Samsung sold 36.5 million SMARTPHONES and that was 40% of their total phone sales so their total phone sales were 91.25 million phones.

It's still on the market

[dmesg0]

The amazing part is that iApps7 games are still on the market (as of this writing, 10PM PST).

It's obvious from the comments that they are total crap though. Anyone literate enough to read the comments wouldn't touch this stuff.

Re:It's still on the market

[oakgrove]

I know amazing right? Why would they just stand there and ask "how high?" when Symantec says jump when they should just start jumping, right? We all know how infallible Symantec is after all.

They have the company details

[Anonymous Coward]

They have the account details for these, they should go prosecute them.

Apple Haters ignore the fact they are more guilty

[SuperKendall]

foxconn factory workers very satisfied: 100%, with no dissent! amazing.

Who makes your Android phone?

Some company that cares even LESS for their workers. At least Apple is trying to help and improve things, but China has a very servile culture embedded that has been pushed on them for many generations. They have a factory culture that has been as it is for a long time now and change is not instant.

So every dig you take at Apple and Foxconn labels you a dirty hypocrite if you use any electronics whatsoever, because even more people suffered for your device to be made...

'Tard World

[Anonymous Coward]

Here's a 'jigsaw' of a half naked young woman, the picture only has 4 sections but I'll download it anyway, what could possibly go wrong?
What do you mean my phone is infected?

This isn't the OS you're looking for.

[Anonymous Coward]

Despite being Linux-based, it is weak-minded. I sold my android device to some other poor, unsuspecting dupe. I got it, played with it for a little while, realized it was basically worthless, and sold it while it still had resale value. Because I bought it at Christmas time, with a steep discount, I actually turned a profit on the little piece of shit. Hahahahahah... sucker. Android has an app store with no vetting process, and that is the heart of the problem. I don't know that it's possible to make an OS where apps are so sandboxed that it doesn't matter WHAT they do. Perhaps if the OS itself had a master control panel at which you could, as the user, and without gaining root, change the permissions of every single program...

But they'll never do that. Linux (and all OS's based on it) suffer the same basic problems other OS's do anymore, because they've become OS designed to be able to run on general purpose machines. So now you've got security exploits, a pain-in-the-ass system (SELinux) that comes bundled that's more annoying than the security default set up that came with Windows Vista, a kludgey patchwork of libraries and it's just a total clusterfuck anymore.

What happened to the UNIX standard from the age of K&R, when each program did what it was designed to do, did it fast, did it well, did it quietly with a modest set of resource requirements, terminated and returned control to the OS?

Now there's almost no advantage to using Linux over Windows, and the disadvantage of it being a big pain in the ass, sometimes. There's a reason why so many Linux distros now are playing catch-up on a 2-3 year lag on features and interface usability with Microsoft and Apple. The reason is because the big boys cleaned up their act, and Linux is becoming increasingly fragmented. Android is useless, I have tried multiple different Linux distros, Windows from 3.1 to 7, and Commodore Basic (pseudo-OS), and MS DOS. I have even tried FreeBSD a few times.

Linux has gotten to be almost as easy to use as Windows, but the myth that you never have to reboot Linux has I think been debunked. Last time I tried Linux, (Mint 11, and Fedora 14, I think) Every time I fired up the computer, the automatic updater would start, and tell me there were dozens of packages that needed to be updated. Frequently this included critical subsystems, (like the kernel itself,) that ended up requiring a restart.

What happened to you Linux? Your ass used to be beautiful...

Anyway, this thread was about Android exploits. Yeah, MOD me down as a troll, I don't give a shit, because this is the TRUTH:

Android is crap. (IOS is also crap, for a completely different reason) but until someone comes up with something better, something that keeps programs in their own space so that they can't jack other files or the system, and that can do all the other things android and IOS phones can do, Android based equipment will continue to be useless. :)

Re:This isn't the OS you're looking for.

[oakgrove]

When drivel like this gets modded up, I know why Taco left. Joke-dot? Slash-gadget? Take your pick.

Speculation

[slasho81]

It may have infected five million users!

Then again, it may have not.

Re:May have?

[VortexCortex]

"In other news, security research firm says they've found alarming evidence of their own relevance.
Details at 11"

That's 5:00 you non-binary-reading troglodytes. I suspect next I'll hear a story about how useful rats are at guarding cheese.

because Dell doesn't put Gandhi in advertising

[decora]

its pretty simple - Apple asked for it. no other company is stupid enough to pretend it is a revolution

Re:because Dell doesn't put Gandhi in advertising

[Anonymous Coward]

You can't even capitalize your sentences properly in a non-realtime conversation.

Re:Apple Haters ignore the fact they are more guil

[iserlohn]

HTC makes all of their premium Android phones in Taiwan. The workplace standards are of course much higher there compared to Mainland China. Samsung, on the other hand uses a number of factories, including ones in South Korea and China to make their flagship Galaxy SII phones.

walled garden for high permissions

[Twillerror]

If you upload an app to the market place that needs access to the users bookmarks I think that a more in depth review process is in order.

At the very lest the user should be see an alert that says something like "This app seems to want a lot on your phone and hasn't been verified by Google...only use it if you really want to "....

Re:iOS has more marketshare than Android

[Anonymous Coward]

So which company are all these AC's shilling for...

Because most of us REALLY don't give a shit which company is #1 or #2.

And still the bottom line is apple is some locked down, fucked up, half assed, lawsuit happy company who has not created anything original in 20 years.

All of you need to fuck off. Really.

Re:May have?

[Anonymous Coward]

It's a good thing they sell Norton Mobile Security to go with those estimates.

Assume the worst and it's 5 million. That's what, around 2% of Android devices? 5 Million is a lot but there are also 195 million devices that aren't running the malware.

Serious question: How much of this is hard spin from a security company that has much to gain from phone owners being scared?

Re:May have?

[fluffy99]

'Symantec estimated the impact by combining the download totals -- which the Android Market shows as ranges -- of the 13 apps, arriving at a figure between 1 million on the low end and 5 million on the high.

Of course Symantec totally ignored that the download totals do not translate into the number of infected users. How many devices have multiple apps? That estimate could easily be 10x too high.

  Did the author run scripts to pump up the numbers to gain visibility? Many app authors do this

Re:May have?

[icebike]

And of course NONE of the anti-virus or malware scanners caught even One instance of this in the wild.

SYMANTIC advertising their own uselessness.

Re:Apple Haters ignore the fact they are more guil

[tlhIngan]

HTC makes all of their premium Android phones in Taiwan. The workplace standards are of course much higher there compared to Mainland China. Samsung, on the other hand uses a number of factories, including ones in South Korea and China to make their flagship Galaxy SII phones.

I just checked my Galaxy Nexus. It says "Made in China", so I'm guessing it's probably a safe assumption it's made at Foxconn.

And while HTC's premium flagship phones are made in Taiwan, I'd guess most of the rest of them are made in Foxconn (for every flagship, there's probably dozens more of the lowend phones sold).

Re:May have?

[marcushnk]

yeah I wish Google would speak to this.
It could be that NO ONE has downloaded these apps...

Taiwan

[Sycraft-fu]

In particular in Taoyuan. HTC makes their products in Taiwan, which is not a large surprise since they are also headquartered there.

Re:Taiwan

[BasilBrush]

And you think HTC in Taiwan is any different because?... http://htcpedia.com/news/activists-demand-htc-relieve-overworked-employees.html

Re:Taiwan

[Anonymous Coward]

In particular in Taoyuan. HTC makes their products in Taiwan, which is not a large surprise since they are also headquartered there.

Well, Foxcon is owned by a Taiwanese guy too. That doesn't mean that they are relocating their factories to Taiwan any time soon...

What are you comparing?

[Anonymous Coward]

So you compare two platforms against each other, and conclude therefore that the ass backwards worst feature of one of them is responsible for the overall satisfaction on that platform?

*slow clap*

The correct conclusion would be that Apple's satisfaction is high do to the crap free, consistent platform they have built around all their products.

But no it must be because of the walled garden app market, uh hum. The saddest thing here is your current moderation.

Re:May have?

[symbolset]

BTW: Symantec is just now disclosing that their servers were hacked in 2006 (as far as they know - maybe earlier). They don't know how long the hackers have PWNed their network, how much control they had, or for how long - but they're quite sure the hackers have stolen some of their source code. They recommend that you not use / disable / uninstall some (most) of their software. Most especially including PC Anywhere, since apparently it has a vulnerability or "back door" that allows the hackers to remotely administer your PC from Anywhere - and has for the last SIX YEARS.

I think I'm going to take Symantec's edicts with a grain of salt from now on, even if this is from a different group.

Why Am I Not Surprised

[rhook]

Look at this list of infected apps.

iApps7 Inc Counter Elite Force Arcade & Action
iApps7 Inc Counter Strike Ground Force Arcade & Action
iApps7 Inc CounterStrike Hit Enemy Arcade & Action
iApps7 Inc Heart Live Wallpaper Entertainment
iApps7 Inc Hit Counter Terrorist Arcade & Action
iApps7 Inc Stripper Touch girl Entertainment
Ogre Games Balloon Game Sports Games
Ogre Games Deal & Be Millionaire Sports Games
Ogre Games Wild Man Arcade & Action
redmicapps Pretty women lingerie puzzle Photography
redmicapps Sexy Girls Photo Game Lifestyle
redmicapps Sexy Girls Puzzle Brain & Puzzle
redmicapps Sexy Women Puzzle Brain & Puzzle

These are all Facebook type games that idiots play.

Re:Why Am I Not Surprised

[dredwerker]

Look at this list of infected apps.

iApps7 Inc Counter Elite Force Arcade & Action
iApps7 Inc Counter Strike Ground Force Arcade & Action
iApps7 Inc CounterStrike Hit Enemy Arcade & Action
iApps7 Inc Heart Live Wallpaper Entertainment
iApps7 Inc Hit Counter Terrorist Arcade & Action
iApps7 Inc Stripper Touch girl Entertainment
Ogre Games Balloon Game Sports Games
Ogre Games Deal & Be Millionaire Sports Games
Ogre Games Wild Man Arcade & Action
redmicapps Pretty women lingerie puzzle Photography
redmicapps Sexy Girls Photo Game Lifestyle
redmicapps Sexy Girls Puzzle Brain & Puzzle
redmicapps Sexy Women Puzzle Brain & Puzzle

These are all Facebook type games that idiots play.

O for my mod points +6 funny :)

Re:Why Am I Not Surprised

[Dixie_Flatline]

I'm not sure why that matters. It was PEBKAC people that were getting infected with viruses on their PCs, too. People that are careful generally don't get malware on their machines.

These are consumer devices, used by consumers. The fact that they have bad taste is largely irrelevant. People don't want to worry about malware on their stoves, dishwashers, espresso machines, vacuum cleaners, phones, or any other appliance. Maybe it's unreasonable for them to think that they shouldn't have to worry about such things on such amazingly capable devices as the average smartphone, but that's the way it is. Leave it for too long, and there'll be a market backlash against the phones that can't protect the user from themselves, particularly when there's an option (iOS, obviously; WinPhone, less obviously) that does for no extra hassle.

Re:iOS has more marketshare than Android

[Demonoid-Penguin]

Slashdot is intentionally not providing you full tech news coverage because it caters to a specific demographic of emotionally-invested users who are more likely to generate repeat page views.

Slashdot is a business whose sole income is advertising revenue. People visit because people visit. The Slashdot business model (Soulskill is an employee) is to promote controversy - The Rupert Murdock Model®. It ceased to be anything ./ related a long time ago.

"unwanted advertisements"

[johnvile]

All Advertisements on the internet or otherwise are "unwanted advertisements"

Re:May have?

[jrumney]

Their low end needs to be divided by 13, as it is possible (though unlikely) that all users that have downloaded these apps have downloaded all 13. And then there are the users who wipe their phones (perhaps because they saw malware symptoms) and redownload. So probably the reality is anywhere between 50,000 and 5,000,000 infections.

Where these apps signed?

[trifish]

I somehow can't imagine malware authors would sign their apps with a valid CA-issued certificate that would prove their identity in court.

Re:Where these apps signed?

[toriver]

I am sure malware writers do not care if their apps get pirated... :)

Re:Where these apps signed?

[Anonymous Coward]

Who talks about pirating? A digital signature proves the identity of the author of the code.

Re:Where these apps signed?

[WarmBoota]

You don't NEED a CA-issued certificate to distribute Android Software. You can simply use the keytool supplied in the Android SDK (http://developer.android.com/guide/publishing/app-signing.html). When you create a market account with google, you need to provide a credit card and a cell phone number, both of which can easily be fraudulent/disposable.

Re:iOS has more marketshare than Android

[Anonymous Coward]

If they wanted to promote controversy, they'd publish this drivel as is.

Because, really "Apple surpassed Android in marketshare" is "Research firm Kantar Worldpanel ComTech said Apple's share of the U.S. market doubled from a year ago to 44.9 percent in the October to December period, just beating Google's Android smartphones, which slipped to 44.8 percent from 50 percent.", "confirming earlier reports by both Nielsen" is "46.9% Android vs 44.5% Apple" and "and NPD [gigaom.com]" is "47% Android vs 43% Apple".

He doesn't even RTFA he links to, with 2 out of 3 "confirms" that are in fact "contradicts".

Re:iOS has more marketshare than Android

[toriver]

But Samsung counts their Bada phones as smartphones as well as their Android offerings...

Good thing...

[Snaller]

... that Symantic says its a Risk Level is at 1: Very Low
That they believe number of "infections" is 1000+

And that to get rid of it all you have to do is UNINSTALL IT.

If you don't it may

        Copy bookmarks on the device
        Copy opt out details
        Copy push notifications
        Copy shortcuts
        Identify the last executed command
        Modify the browser's home page
        Steal build information (for example: brand, device, manufacturer, model, OS, etc.)

And a variant might also transmit

        Android ID
        IMEI
        IMSI
        MAC address
        SIM serial number

Eeek.

opportunity to compete against google

[WindBourne]

Seriously, this is an opportunity for a company to come up with a new market to compete against Google. Basically, set it up similar to Apples: submit the app, have it tested, etc. and charge a small amount of money. For me, I will stay with google. BUT, for my parents and in-laws, they would go with the secured market.

Re:iOS has more marketshare than Android

[symbolset]

The trade press is getting less and less neutral lately. That has to cost a lot of money.

Re:May have?

[jonbryce]

I think when they say downloads, they mean "purchases". If you download again on the same google account, I don't think that increments the counter.

unwanted advertisements

[McGiraf]

wet water

Re:May have?

[Calos]

And there's a (probably small) number of users like me, who will occasionally install something against my better judgement that I need for a one time use... and I neuter the permissions with things like DroidWall, LBE Privacy Guard, Permissions Denied, and others... and I think CM7 included its own permissions control.

Hell, even "normal" apps need some control. Many, many apps want access to your phone ID (IMEI, etc.). Block, block, block. That's a hardware ID unique to your handset. Only good reason to grab it is user tracking.

Wanted Advertisements??

[nemesisrocks]

and displays unwanted advertisements

Call me ignorant, but when are advertisements ever wanted

I understand that advertisements are a "necessary evil" in order to pay for development costs, etc, but I can't ever think of a situation when I've ever wanted to see advertising.

Apart from perhaps the Superbowl.

Re:Wanted Advertisements??

[Dixie_Flatline]

Really? You've never seen an ad and thought, "Man, I was JUST thinking I'd like a product that does something like that!"

And then you've got the Superbowl, so you can't say that you've never wanted to see advertising. You just want to see GOOD advertising. I think that's a reasonable desire.

The problem with advertising is that generally, it sucks. Especially on the internet. But remember the 'i love bees' halo campaign? That was advertising, and that was awesome.

If you don't like certain ads, do two (or potentially three) things:

1) Don't buy the product. Obviously.
2) Let the company know that you hated their ad and won't buy their stuff. They actually pay attention to that sort of thing, apparently.
3) Contact whoever is running the ad and tell them that it was particularly bad, and you're not happy with having to see it. (This works especially well with people that run ads from ad networks on their websites. I know several folks that really want to hear what sort of ads you don't want to see on their sites, and they'll contact their ad networks and get those ads removed.)

I know 2 & 3 take some effort, but you can make a difference if you want to.

Maybe users ...

[Anonymous Coward]

also should try to be less stupid and not give every little app all the rights they are demanding for no apparent reason at all.

Re:May have?

[Troke]

They recommend that you not use / disable / uninstall some (most) of their software.

I think any IT professional worth their salt has been recommending removal of their software for years.

Regulation is good

[Night64]

If I understand well, what you are saying that apps should be a highly regulated market. From TFA: " Although the infected apps request an uncommonly large number of privileges -- something that the user must approve -- Haley argued that few people bother reading them before giving their okay." If I am allergic to nuts, and I don't bother to read the big red label that some cookies contain nuts, if I get in a coma, hey, that's Nabisco's fault, not mine! They should KNOW I can be bothered to read some boring warnings. I want my cookies, and I want NOW!

Re:Regulation is good

[BasilBrush]

A nut allergy is a personal requirement. The rejection of malware is a universal requirement. It's like expecting Tesco or Walmart to not sell food with toxins in.

Re:Regulation is good

[psiclops]

i was going to reply with something about not being allergic to malware, but you explained what i wanted to much better than i would have.

Re:May have?

[Whibla]

Details at 11"
That's 5:00 you non-binary-reading troglodytes. I suspect next I'll hear a story about how useful rats are at guarding cheese.

11 in Binary is 5?

Damn, I knew I was getting old, because it used to be only 3...

Re:May have?

[AngryDeuce]

It's hard to take anything Symantec says seriously as regards security. They have every incentive to make things seem far worse than they really are. Does Symantec offer an antivirus for Android?

Re:Apple Haters ignore the fact they are more guil

[BasilBrush]

Don't kid yourself. HTC is the same as the rest. http://htcpedia.com/news/activists-demand-htc-relieve-overworked-employees.html

MakeAFee and Scamantec

[Anonymous Coward]

Good to see that MakeAFee and Scamantec are active again in sponsoring dumbware^Wmalware writers, in order to promote an AV business on mobile they are trying to ramp up since quite some time.

Re:MakeAFee and Scamantec

[Anonymous Coward]

Good to see that MakeAFee and Scamantec are active again in sponsoring dumbware^Wmalware writers, in order to promote an AV business on mobile they are trying to ramp up since quite some time.

Been there. They do that. Fact.

Re:iOS has more marketshare than Android

[MisterSquid]

Slashdot is a business whose sole income is advertising revenue.

Slashdot also generates money through paid subscriptions.

That's what I though android had

[ukemike]

I've always thought that apt (apt-get, aptitude, Debian) has the right solution to this.

You get your software from a repository, and only software that is approved by the maintainers of the repository gets in.

Then, _you_ get to choose which repositories you trust.

That way, you don't have to judge the quality of all software yourself. You can leave that to the people who maintain the repositories. They will build up reputation over time, and you can go with the ones that have a good enough reputation by your standards.

A walled-garden app store like Apple's basically implements the first part of this. This is fine for a lot of people.

To also cater to those who want more freedom, without opening the flood gates, all you have to do is allow them to shop at other app stores, as well.

That's what I thought we had with android. There is the main android market, which I assumed had software that had been vetted in some way, and there are other markets, which could have lots of scary stuff. I do know from reading that the various malware scanners are almost worthless. So the iPhone model of the walled garden isn't used, and since virus scanners are useless, the PC model isn't used, what is an end user supposed to do?

So is there somewhere online that I can search to learn at least which apps are known malware?

You asked where it was made

[Sycraft-fu]

I answered. Don't get mad if your attempt at being smarmy backfired. Not everything is made in China.

Also there's the fact that Taiwan has a much higher standard of living and pays much greater wages.

Re:You asked where it was made

[BasilBrush]

I answered. Don't get mad if your attempt at being smarmy backfired. Not everything is made in China.

It didn't backfire in the slightest, I wasn't looking for the answer "made in China". As my link to the HTC article shows these problems are far more widespread than just China. It's everywhere that can afford to compete for consumer electronic manufacture.

Also there's the fact that Taiwan has a much higher standard of living and pays much greater wages.

Taiwan jumped on exactly the same capitalist consumer electronics manufacturing track that China is on. But the did it earlier. They are just a few years father on down the track of development.

Foxconn is a Taiwanese company. What they are doing now in China the started doing in Taiwan.

Android Malware ?

[microphage]

A total non-issue .. once you download an app from an unknown source, then it's game over !!!

Re:iOS has more marketshare than Android

[realityimpaired]

And WinMo *is* a smartphone platform...

That being said, when you combine all of the offerings from all of the different manufacturers on all of the carriers around the world, I have a hard time believing that Apple managed to surpass all of the sales of Android with only 37 million sales.

MORE PROOF THAT LINUX DOES GET MALWARE

[Anonymous Coward]

Am I right? Yes Sir. Prepare for the onslaughts of naysayer spinmaster bullshit forthcoming from troll penguins who can't accept the truth that once a Linux of any kind gets used by masses, most especially those who are just "end user" types, it will be abused as much as Windows was for years. So much for the years of b.s. spread around that Linux = Secure, because it's not showing anyone that much on SmartPhones (PC's in & of themselves really).

Re:May have?

[fluffy99]

It's hard to take anything Symantec says seriously as regards security. They have every incentive to make things seem far worse than they really are. Does Symantec offer an antivirus for Android?

Yes they have a number of products for Android, so yes they aren't exactly non-biased.

http://us.norton.com/mobile-security/

View the Source Code!

[Anonymous Coward]

The one thing that sets the Linux ecosystem and the GPL apart from the proprietary world is that the source code can be read. Without this principal, anyone can force your device to do their will. That is why you can't trust forks of BSD licensed code. Microsoft thinks that they can solve this with signed code.

Even Android, with Linux at it's heart is vulnerable to attack by proprietary packages. The Debian and RPM packaging systems have the same issues. When are we going to accept that reading the source code is a fundamental freedom and that there is no such thing as "Trusted" computing?

Re:iOS has more marketshare than Android

[Demonoid-Penguin]

Slashdot is a business whose sole income is advertising revenue.

Slashdot also generates money through paid subscriptions.

Oh right - how could I overlook that? It makes a huge difference.

Do they sell t-shirts too?

fuck yeah! open platforms rule! fuck apple!

[Anonymous Coward]

Nothing like getting malware and virus on your phone! free software 4 life, yo!

Re:Apple Haters ignore the fact they are more guil

[Anonymous Coward]

LOL, considering their first phone was made with materials environmentally unsound that have been eliminated in all major manufacturers at the time (BPA, if I recall correctly) for at least 5 years, I don't think big red gives a rats ass (until someone noticed and there was a media furor over it).

16 billion dollars in the piggy bank due to them charging a premium on old hardware and a bit being greedy siphoning 30% off of everything that passes through their devices (dual core 1GHz was so last year when they came out)... You're telling me they can't add a few more dollars to the wages of their workers? I have to call BS on "trying to improve things". Even if they gave an extra $1,000 to each and every worker in the plant ignoring who makes way, I don't think they'd even notice it missing. Quite literally, they could tell Foxconn to do things their way or it's the highway and you'd watch the magic happen. They won't, because that would cut into their insane margin.

Most other manufacturers don't have this halo effect on people like you, so they actually have to charge reasonably (the brand new 32GB quad core Asus Transformer prime is the same price as a dual core 16GB fruit stamped tablet). All other manufacturers are starting to get the message. Their margins aren't as great because they actually have to work for their share. They MUST rely on cheap labour to get their product out cheap.

Re:Apple Haters ignore the fact they are more guil

[mjwx]

I just checked my Galaxy Nexus. It says "Made in China", so I'm guessing it's probably a safe assumption it's made at Foxconn.

Erm, Foxconn is not the only company in China.

Much like Asus, Samsung runs their own production complex in China.

And while HTC's premium flagship phones are made in Taiwan, I'd guess most of the rest of them are made in Foxconn

Bolded the key word. Once again, there's no evidence of this but nice try to spread FUD.

Re:Apple Haters ignore the fact they are more guil

[iserlohn]

IIRC, all GSM Galaxy Nexuses are made in Korea in 2011.

Re:Apple Haters ignore the fact they are more guil

[iserlohn]

That seems to be an isolated incident of an engineer, not a factory worker, so no, it is not the same.

Re:Apple Haters ignore the fact they are more guil

[BasilBrush]

That seems to be an isolated incident of an engineer, not a factory worker, so no, it is not the same.

What was it you didn't understand about "engineers and factory workers" in paragraphs 2 and 4.

And that was just a random pick of the many articles that Google returned.

If you think the working conditions are any better at HTC than Foxconn, you're deluding yourself.