Slashdot Mirror
Defending Your Cellphone Against Malware
Hugh Pickens writes "Kate Murphy writes that as cellphones have gotten smarter, they have become less like phones and more like computers, and that with more than a million phones worldwide already hacked, technology experts expect breached, infiltrated or otherwise compromised cellphones to be the scourge of 2012. Cellphones are often loaded with even more personal information than PCs, so an undefended or carelessly operated phone can result in a breathtaking invasion of individual privacy as well as the potential for data corruption and outright theft. But there are a few common sense ways to protect yourself: Avoid free, unofficial versions of popular apps that often have malware hidden in the code, avoid using Wi-Fi in a Starbucks or airport which leaves you open to hackers, and be wary of apps that want permission to make phone calls, connect to the Internet or reveal your identity and location."
Pickens continues: "One common ruse is a man-in-the middle attack when a target receives a text message that claims to be from his or her cell service provider asking for permission to 'reprovision' or otherwise reconfigure the phone's settings due to a network outage or other problem. Don't click 'O.K.' Call your carrier to see if the message is bogus. For the more paranoid, there are supersecure smartphones like the Sectéra Edge by General Dynamics, commissioned by the Defense Department for use by soldiers and spies which may soon be available to the public in the near future. 'It's like any arms race,' says mobile security consultant Michael Pearce. 'No one wins, but you have to go ahead and fight anyway.'"
Use a Blackberry. Lack of apps aside, even if the malware authors want to code one, the antiquate API would drive them to whiskey abuse.
And of course the main platform prone to issues is android. Flame al you want but the endless reports of various significance all show it's true that android is more prone to malware than iOS and windows phone
Bitch please :D
twitter.com/ismetozozturk
So, in other words, all apps that actually make use of the fact that it's a mobile device able to determine its position in real space to enhance the user's real-world experience...
Sounds to me like the OS makers need to address this, and give user-level ways of doing things that don't compromise the whole system if something nefarious happens, and then also give the manufacturer of the OS the ability to alert users when the manufacturer learns of malicious applications so that they can be removed.
Do not look into laser with remaining eye.
And they'd have been just as wrong too.
The "install an infected app from the app store" route is only one of many ways to infect a device like this. A remote exploit, like how Microsoft's browser brings down hundreds of thousands of PCs a year, is much more likely IMHO to cause real widespread chaos.
Do not look into laser with remaining eye.
By "cellphone" they actually mean "Android". I've never heard of iOS, BlackBerryOS or WinPho7 having any serious malware issues, granted there have been a couple of minor incidents, but Android seems to be the platform of choice to have your phone join a botnet.
My iPhone doesn't tell me when an app wants permission to connect to the internet or share/sell my personal information with 3rd parties :-(
What spyware is installed on an iPhone out of the box, pray tell?
Mainframe/UNIX Bit Twiddler and long time Windows/Linux Hobbyist.
The Theorem Theorem: If If, Then Then.
iOS?
With iOS, there is not much one can do about malware, if it gets past Apple's gatekeepers. JB-ing the device and slapping on Firewall iP is probably the best thing one can do. However, the barrier for entry for malware writers is very high. It is pretty difficult (and more expensive) for a blackhat organization create a new account with Apple , paying them a C-note a year), and cook up some personal info (like bank accounts and such to register under) to even be able to see iTunes Connect, much less have the app approved. This has done a good job in keeping iPhone users safe, although in theory, if an app decided to have some type of module that would allow code execution, users would never know about an app that would be slurping contact info, E-mails, and other items then shipping that off to a blackhat server, especially if the app was smart enough to do it only on Wi-Fi, or a small trickle over 3G.
Because of this, the only permission iOS asks for is for using the GPS. Since the App Store does all the work essentially, there isn't that much of a need to have anything more than that.
Even with Firewall IP, there is no protection against apps deciding to spam with SMS, other than Apple's gatekeepers.
So, Apple's security model may have some (in theory) bad flaws, but it has proven to be decently tight, with exploits being used for jailbreaking as opposed to turning the device into a mobile money machine for criminal organizations.
Android's model is more robust in some ways. If Android phones were shipped with a marketplace that vetted/approved apps [1][2], this would virtually eliminate compromised phones [3].
The nice thing about Android is that even with full root and a custom ROM, app security is just as tight as it is on a vendor ROM. Unlike jailbreaking on iOS which completely creams the security model, apps on Android still function exactly the same on a rooted phone, other than being able to prompt the user for su access.
Since Android isn't reliant on a store's gatekeepers, its permission model has to be robust. It has been OK so far, provided users read and disallow apps like a game demanding full access, but it would be nice to have a better model -- something along the lines of minimum permissions needed to run the app, optimal permissions, and maximum permissions (a notepad app that just stores notes in its directory generally does not need full access or access to root unless it has some special features.)
What can help Android immensely would be an app that runs as root and can allow/disallow access to SD cards, contacts, SMS, phone, and networking. There is an app called LBE Privacy Guard which runs as root and offers features that should really be part of Android (perhaps some features behind an Advanced menu.) CyanogenMod also has similar features for restricting access.
Another app that is a must have for rooted devices is DroidWall, which is essentially a shell for performing iptables commands. This is an immense help because it can not just block network access for apps, but limit the bandwidth hogs to Wi-Fi (or security sensitive apps to 3G).
Pretty much for the tl;dr in all of us, Android would be best off with two tiers of stores, and having the user go through a dialog of "these apps are untested, but the reviews will be a good guide. Use at your own risk" before a user gets access to the free-for-all market. Couple that with the functionality of DroidWall and LBE Privacy Guard which can be set to prompt/allow/deny access to critical things (contacts, network, phone, SMS) integrated into the OS, and Android would be a lot more secure.
[1]: Amazon is good at vetting apps, and it would be nice for Google to offer two tiers of their Marketplace, where one tier would be the current free-for-all, while having another tier (which would cost app developers more because of the time taken) just for apps that would have a "blessed" flag attached.
[2]: It goes without saying to have a way to add more stores, or if Google w
And the more I read about this, the better off I think I am.
Seriously, this summary sounds like there is really no way around this BS except by using a dumbphone and never connecting anything to the Internet.
>free app clones of pay ones are a problem
No, closed source "free" apps are the problem.
--
BMO
Don't download every dumb shit dancing santa talking cat bullshit app your mom's co-workers recommend
option B is to not use a smartphone and get over your facebook/twitter addiction
So we are once again stuck onthe myth perpetuated by the Apple marketing machine that iOS is secure.
Lets disregard that it's been hacked repeatedly and easily, and lets also forget the tens of thousands of people who've had there iTunes accounts hacked and been charged for apps they have never downloaded (I know of 3 personally, none of whom ever got their money back)
But yes, the 50 (out of 400,000) malware infected apps are scary.
> Apple already screen it for you.
Don't you mean Apple already sold it for you?
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
And why is there a constant need to feed this fear? If I get a weird text message, I ignore it and delete it. "Security measures" that one takes when browsing the web on a computer should apply for cell phones! If you get a pop up saying "click here to jailbreak now" or "click here to get free i-p-a-d" or "click to see my naughty pictures" or "click here to increase your manhood," etc. of COURSE that's fake and should be closed/ignored! If you download apps for your cell phone, then read the reviews! Try to determine if it's a trusted source if possible! Taking these safety precautions under ANY device will make you 99.9% malware proof! Why is this posted on Slashdot? This is the kind of content that the brainless general media would repost over and over again! Not a technology-savvy site!
It has been patched but this has happened already.
Any system which allows users to run 3rd party software of their choosing is going to be vulnerable to the stupidity of its users. You can't fix stupid users without putting them in a jail cell.
As long as the user is the primary attack vector it's hard to make a blanket statement about a platform's security. Back when Windows would get infected simply by bing turned on and connected to a network without the user doing a damned thing, it was easy to make a blanket statement about how secure Windows was. And even though the trolls told us that there was nothing Microsoft could do because they were the most popular OS, Microsoft did finally do something and the platform did finally become more secure. Once again things have shifted to target the user rather than sending malformed packets and overflowing buffers. It's hard to call a modern Microsoft OS insecure because the attack vector is more commonly stupid user now.
If we can call MS's slow bloated crap secure because it's all or at least mostly on the user, then we can call Android secure too. Sure neither one is as secure as the walled garden but like I said, it's jail or freedom to fuck yourself.
DO THE FOLLOWING (after obtaining a good reputable solid HOSTS file, like mvps' -> http://www.mvps.org/winhelp2002/hosts.htm
---
1.) Get ahold of the "Android Debugging Bridge" (ADB) & install it
2.) Mount your system mountpoint as READ + WRITE (as powerful of priveleges as you need is this)
3.) Using the PULL command, copy the file over from your PC (or even on your ANDROID if its there already) using PULL & overwrite the etc. folder's copy of HOSTS
---
* DONE!
(Yes, it's THAT simple vs. hosts-domain based threats which ARE THE MAJORITY OF THEM OUT THERE (because hosts-domain names are recyclable unlike IP addresses)... &, it works - you CAN'T be burned if you can't go into the malware kitchen!)
APK
P.S.=> Of course, your HOSTS file will need to have the domain/hosts name of the C&C servers, & that you have to obtain for this to work vs. threats like bogus servers &/or maliciously scripted sites. Here's some good sources for that above & beyond mvps.org (I noted them above):
http://hosts-file.net/?s=Download
http://www.malwaredomainlist.com/hostslist/hosts.txt
http://mirror1.malwaredomains.com/files/ (justdomains here)
http://pgl.yoyo.org/as/serverlist.php?hostformat=hosts&showintro=1&mimetype=plaintext
http://sysctl.org/cameleon/hosts
http://someonewhocares.org/hosts/
http://hostsfile.org/hosts.html
http://hostsfile.mine.nu/downloads/
https://zeustracker.abuse.ch/monitor.php?filter=lastupdated
https://spyeyetracker.abuse.ch/monitor.php?filter=lastupdated
http://www.malwareurl.com/
http://www.safer-networking.org/en/download/ (updater for Spybot "Search & Destroy" & it fortifies HOSTS files)
Those are some of my regular sources that are reputable & reliable for custom HOSTS file data populations vs. known threats online - I consolidate them here via programs I wrote that normalize/deduplicate repeated entries, sort/alphabetize the results, & change from larger + slower 127.0.0.1 (longer & loopback ops happen here) to the faster & smaller 0.0.0.0 (or even 0 on Windows 2000/XP/Server 2003): Enjoy!
... apk
The article likes to make it sound otherwise but iOS does not have this issue.
No, closed source "free" apps are the problem.
It's not realistic to think that everyone would compile applications if they could, or be able to do a source audit to see they are truly safe.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Probably CarrierIQ. Apple has admitted it's there, but not enabled by default.
CarrierIQ is on a lot of phones, including Android phones, so this point is moot anyway...
To me, deliberately jail breaking your iPhone isn't malware. And, from the article you quoted, "the security impact of these vulnerabilities will remain theoretical." You're making a big jump by going from something that you initiated to something that happens by visiting a maliciously-coded Web site.
If I used a sig over again, would anyone notice?
If you want a curated market for Android like Amazon Appstore, you know where to find it.
So we are once again stuck onthe myth perpetuated by the Apple marketing machine that iOS is secure.
Oh boy, "Apple marketing machine" eh? Queue "imperial march."
Lets disregard that it's been hacked repeatedly and easily
Hardly easily. The first jailbreak admittedly was easy, but take a look at the iOS hackers blogs: jail breaking these things is now crazy hard. Jailbraking now takes multiple exploits and a phone which is physically connected to your system. The latest exploits took months to develop, all the while people are told not to upgrade because the upgrades invariably patch the holes.
Anyway jail breaking is a red herring, what counts is exploits used in the wild. And to the best of my knowledge that's still a big fat 0 for iOS, which is why these articles invariably talk about Android.
and lets also forget the tens of thousands of people who've had there iTunes accounts hacked and been charged for apps they have never downloaded (I know of 3 personally, none of whom ever got their money back)
But yes, the 50 (out of 400,000) malware infected apps are scary.
iTunes is not iOS. They are completely separate products. The security of one has no bearing on the security of the other.
If all else fails, immortality can always be assured by spectacular error.
The malware can simply execute the latest jailbreak exploit are the fanboys are so excited about.
That is why Apple quickly fixes remote exploits but leaves tethered jailbreaks alone.
The ability to do what you are suggesting is never an option for long enough that malware can make use of it.
Of course, on Android you have another problem - since many carriers are so reluctant to update, you have vulnerable Android versions handing around a LONG time. That makes it even more appealing for malware writers.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
My iPhone doesn't tell me when an app wants permission to connect to the internet or share/sell my personal information with 3rd parties :-(
Mine does. Requests per domain per app (asked once when the app tries to connect), and requests for listening sockets.
http://isource.com/2009/11/05/firewall-ip-a-firewall-app-for-the-iphone/
If you are not jailbroken, then you can only use the Apple store, and those apps are tested at the API level to verify what they do.
Sure you can't block banner ads this way, but that is by design.
Jailbreak it, and you get the Cydia app, and access to multiple stores (same repo system as apt-get, which you get installed too)
First thing you install with Cydia is the patch for the local exploit if you have any in your version of iOS. Most these days require locally rebooting the phone in a specific debugging mode, so not a remote exploit but a local one. Yes, if you ever lose a smart phone, assume you have no security in place.. For any brand/model/OS. Physical access and all that.
Between Firewall-iP and iBlacklist, I fully control every piece of data going into or out of my phone, be it calls, sms, or data.
There's always a first time, but I think there's a good chance the security impact of these vulnerabilities will remain theoretical. Despite JailbreakMe 2.0 being open sourced after an updated version of iOS was released, which would have made it relatively easy to modify the code into an attack, I didn't hear about any such modification except a proof of concept that showed up much later.