Slashdot Mirror
Mobile Ads May Serve As a Malware Conduit
alphadogg writes with this excerpt from Network World: "Many mobile apps include ads that can threaten users' privacy and network security, according to North Carolina State University researchers. The National Science Foundation-funded researchers studied 100,000 apps in Google Play (formerly Android Market) and found that more than half contained ad libraries, nearly 300 of which were enabled to grab code from remote servers that could give malware and hackers a way into your smartphone or tablet. 'Running code downloaded from the Internet is problematic because the code could be anything,' says Xuxian Jiang, an assistant professor of computer science at NC State."
Don't like it? Don't use it.
Please buy our products!
:. Ultimate Control Dedicated/VM Servers
on an android system level?
etc/hosts, or dns blacklists?
He tried to kill me with a forklift!
Isn't there a way to sandbox the process running the ads?
I suspect the "ad block effect" that I'm used to from years of firefox will exist on android very soon. "(shock amazement) Thats what the unfiltered internet looks like now? how can anyone use that? (insert more shock amazement)"
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
I really didn't want to root my Gnex and lose all my settings and such, but it looks like I may have to anyways. Wonderful.
Wasn't it the case just several years ago that "adware" and "malware" were considered to be mostly synonyms? I don't see why, just because the plarform changed, they would behave any differently. You're back to the Bonzi Buddy "goodness".
I just stay away from any "App Stores" and "Foo Markets". A Debian chroot (when there are no native builds) means the code I run can be trusted.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Got root?
An iptables front-end on Android. Droid Wall is sweet: https://play.google.com/store/apps/details?id=com.googlecode.droidwall.free
As each android app runs as a separate uid, it makes it easy to block net access app-by-app. The problem, of course, is when the app you don't really trust needs net access for a real reason. Sometimes you can allow net access, let the app do it's thing, then revoke it so it's not background connecting all the time.
Also the ability to set some apps wifi-only and others 3G-only is pretty handy. This saves hours of battery life.
that's the real solution. It was only a matter of time... this type of exploit (and others to come no doubt) are the strongest argument for blocking ads.
If you want people to buy your app, create a good app and provide a malware/adware/shareware free/lite version of it. If it is a good app then people will buy it. You piss people off before they have a real chance to test your app then you stand to lose that customer. Those that do not buy your app after trying it would not buy it under any circumstance. I will continue to block apps as long as I have a means to do so. And, I will continue to buy apps from those DEV's that actually create good apps and provide them without the hassle of dealing with the garbage on the side.
Mobile ads are just like traditional website ads? A massive infection vector?
Poorly secured servers that touch millions of individual hosts across millions of different sites, by design?
Scummy ad vendors that don't care that they're linking to dropper sites?
Yeah, not suprised. You can't trust ad vendors at all.
Ad-Aware and other ad blockers are really security products. Blocking ads is just a pleasant side effect.
We're beginning to see the cracks in the Android dam
I don't think there ever was a dam- I've been able to install anything I want on my Android as long as I've had it. People will exploit devices and services whether it is Android, Windows, Mac,or Linux. That's life, and it's the risk we take to have the freedom to do what we want on our devices. Freedom isn't free, right?
For years I've been telling fellow mobile developers that in exchange for ad revenue - or even for usage statistics - they're giving up AT MINIMUM the privacy of their users -- something which isn't theirs to give up in the first place. As ad libraries grow more complex, it's certainly no surprise to learn that there's more than privacy at stake.
When you incorporate libraries that give up part of your control over your application, you can also be certain that you're giving up your users' control over their device.
I can only speak for Android, since I don't own an iDevice, but the market is so saturated with ad-driven apps that it reminds me of windows some years ago, where everything was adware or shareware.
Being from a Linux world where you get pretty much free (in both meanings) access to tools and programs, check/edit the source and other things, Android feels like a wild jungle, so closed and just feels like it's kind of hostile to the user, somehow.
Besides, you are getting ad-based versions of paid apps as "FREE" most of the time. So you are paying with ad revenue and purchases. I bet there are paid apps with ads as well.
One problem with ad libraries, which are served up via Google, Apple [emphasis mine] or other such companies, is that app users essentially give them the same access permissions as the apps themselves, allowing them to skirt standard security processes.
This is still a threat on iOS - ads don't just come in free apps, the browser can load them on websites too. Detecting and serving specific ads to specific hardware is trivial.
'Running code downloaded from the Internet is problematic because the code could be anything,' says Xuxian Jiang,'
Take it from the Chinese guy.
This isn't pure altruism but simply because I don't want my app tainted by scummy annoying ads or malware. I get a lot of spam from alternative ad providers with a hook such as I can earn 10x as much money by using their service. But a cursory glance at their marketing blurb leads me to conclude that their business is usually derived from enticing users to take surveys, 30 day trials and run other apps and all with far broader permissions such as read/write from SD, GPS location and so on. One advertiser worryingly also says they install "ad icons" on the user's phone meaning that my app would have to have ask for a pile of permissions just to enable this crap and it wouldn't be for the user's benefit.
So as a responsible developer I stick with AdMob. But I can see how the danger is there. My advice for end users is only install apps which ask for a minimal set of permissions and uninstall apps which start serving annoying or dodgy content. Perhaps it won't stop attacks occurring but at least it means they won't be occurring for people exercising some restraint and common sense.
Take a look at the author's blog on Networkworld (click on his alphadogg tag in the byline). Mostly "i"thing announcements. Gee, I wonder if his "research" is skewed.
He's really confusing 3 things in the article:
1) Ads have the same permissions as the app itself. However, HTML has no provisions to access the filesystem automatically. It would only have access to your GPS should the originating app also have permission.
2) Downloading code? Downloading HTML is practically harmless to the running state of the OS; it might damage your privacy a bit, but that's it.
2.5) Is it talking about apps that try to get you to install more programs? On Android, you're still greeted with a permission screen at least.
Again, all 3 of these could apply to ALL Operating systems, but for some reason has a heavy Android slant. I mean seriously, "to grab code from remote servers that ***could*** give malware and hackers a way into your smartphone or tablet."? They reviewed 300 ad networks and found that it "could"? I could catch all sorts of diseases by sitting on a public toilet, do you see anyone getting cancer/AIDs/STDs?
I immediately thought of Saren saying "One step closer to finding the conduit." Been playing too much Mass Effect :)
The vast majority of posts I see point out the obviousness of rooting your phone and running any of a number ad-blockers and how great they are. That's no different than someone responding to a regular Joe's desktop Linux complaint with a "Duh, change your config, rebuild your kernel and move on....". You've just lost the average person who might otherwise be interested in playing. The VAST majority of Android users have absolutely no ability or interest in having to "root" their phone, finding a good ad-blocker, and then install it. There are millions of people having a less-than-steller experience, probably not even realizing what's going on and the best answer from the tech community isn't "Let's fix the process", or even "Let's exhort Google to fix the process", but rather an almost patronizing rolling of the eyes and an explanation of how "easy" it is to fix.
HOW TO INSTALL A CUSTOM HOSTS FILE ON AN ANDROID SMARTPHONE:
DO THE FOLLOWING (after obtaining a good reputable solid HOSTS file, like mvps' -> http://www.mvps.org/winhelp2002/hosts.htm ) OR better yet, HpHosts -> http://hosts-file.net/?s=Download
---
1.) Get ahold of the "Android Debugging Bridge" (ADB) & install it
2.) Mount your system mountpoint as READ + WRITE (as powerful of priveleges as you need is this)
3.) Using the PULL command, copy the file over from your PC (or even on your ANDROID if its there already) using PULL & overwrite the etc. folder's copy of HOSTS
---
* DONE! Yes, it's THAT simple... &, it works!
No 3rd party apps required @ all/whatsoever + completely free also since folks already have one on ANDROID smartphones!
(Other types of smartphones too. I simply note android because last I knew of, it even surpassed iphones out there in terms of marketshare).
As to my subject-line?
Well, there's a pack of idiots around here that calls me "hosts file troll", but they NEVER ONCE MANAGE TO DISPROVE FACTS I PUT OUT REGARDING HOSTS FILES... (20 of them vs. AdBlock &/or DNS Servers alone in fact).
Not once, for years now, in fact.
Who are they?
No doubt malware makers themselves, or webmasters losing out on adbanner views!
(Too bad the latter don't admit they suck up CPU time, RAM, & other forms of I/O a user pays for, including electric power, as well as bandwidth & speed a user pays for out-of-pocket... & adbanners loaded with malicious script? Tons of that happened over time now... want proof? Just ask, I'll put out a TINY sampling of it (dozens)...
Who else agrees with me on it?
Mr. Stephen Burn of hpHosts, & here is a quote from he on it as we discussed this this week in fact, and how the idiot trolls around here tried to libel & mock myself calling me "hosts file troll", when hosts files are for helping folks get FAR better speed, security, and even anonymity to an extent (vs. DNSBL + DNS request logs):
---
"I don't actually get time for many sites such as slashdot anymore, but certainly see my fair share of trolls on the MyWot (Web of Trust (I'm a moderator there, and MyWot includes hpHosts in their "ratings")) and Malwarebytes forums, and you're correct -it's always either users of malicious software/sites, or the owners of such, that are doing it."
---
It doesn't take a brain to realize that anyone harassing, stalking, & libelling myself as they have here repeatedly to no avail (they've never disproved points I make about hosts files benefits for users of them I extolled above after all), is done by those who gain by people NOT using them.
(That came about after I submitted a 64-bit hosts file mgt. program to he is why, another story in & of itself where I proved COMODO & Arcabit have problems with exe compressors & produce false positives)
APK
P.S.=> You MIGHT have to run a Dos-2-Unix program over your custom HOSTS file, per the above directions for installation into an ANDROID smartphone, & especially IF you didn't import one built for *NIX, but that's about it (since ANDROID is a Linux & thus, yes, a *NIX variant essentially)... apk speed a user pays for out-of-pocket...
1) Require that anything in the android market have its source uploaded to a Google repository.
Goodbye Angry Birds, and EA...
Have all apps compiled by Google.
As a developer I am greatly dismayed by the idea that I may have to fix bugs introduced by Google messing up compiler settings.
Give the ad library a "master switch" to turn off ads in an app, in exchange for an amount of money commensurate with the proceeds from ads. Therefore all ad-based apps can become no-ad apps in a uniform way.
That's not a bad idea, but the ad company builds the library so how will they get money from the action that kills off the only revenue stream they have?
Make the ad library a separate app (ad server) with its own permissions so that the app,
I'm not sure you understand how many different ad libraries there are, you seem to think of this as there being just one.
Make all paid apps "try-before-you-buy" with a reasonable time to evaluate, like a few days.
If only Apple and Google would BOTH do that. It is in the power of the system to de-atuth after some time....
Finally, addressing TFA, return to the text-based ads that made Google famous, and get rid of the current invasive android advertising.
Too late for that I'm afraid.
Requiring open source will seriously discourage malware
I am very doubtful that would be the case. Lots of malware is just copied from elsewhere. They don't care if people find out after a bit, by then they have what they wanted from a lot of users.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
And I may or may not know that Xuxian Jiang, the researcher at NC state, is a fear mongering self serving blowhard.
1. We already know that every fucking ad network out there can "track location" to give you ads based on geolocation.
2. There is nothing inherently more dangerous by ad libraries downloading data, or "code", to devices. They can't break permission models, so the downloaded code can't do anything more than the apps can anyways.
3. The ad library itself would have to be malicious in order to execute malicious code.
I hate fear mongers.
I am sure nobody will remember this post while they accuse you of being an Apple shill/fanboi.
Jesus was all right but his disciples were thick and ordinary. -John Lennon
Which serving up ad banners uses more battery life/electricity, and ad banners HAVE BEEN KNOWN TO BE INFESTED BY MALICIOUS CODE more than "just a few times" over the past decade++ now also...
* Assuming of course, that any apps that are merely "fronting" for, or doing the same as (like AdBlock or even a local DNS server) custom HOSTS files can do, for free & for LESS ( doing more with less = good engineering) are indeed, funding themselves via adbanners.
Some do... but, lol, not sure an adblocking app would (that'd be ironic!).
By the by: You're reading the words of a MANY time internationally published shareware/freeware (even "open SORES" contributor lately) and commercial software code programmer-analyst/software engineer, since 1995... so, it's "been there, done that" here, dozens of times (over 40 apps out there over time since then, & I "laid off" around 2004/2005 or so).
APK
P.S.=> You MAY want to refer to this:
http://tech.slashdot.org/story/12/03/19/1750233/free-apps-eat-your-smartphone-battery
Because I've been noting THE SAME THING about using HOSTS files vs. DNS servers locally (or ring 3 / rpl 3 /usermode apps like AdBlock which doesn't even work as well as it used to vs all ads by default anymore either -> http://news.slashdot.org/story/11/12/12/2213233/adblock-plus-to-offer-acceptable-ads-option ):
There's an ENTIRE ARTICLE with a BODY OF RESEARCH regarding it today in fact, backing points I've been making for YEARS in favor of hosts files (which are a filter for the ring 0 / rpl 0 / kernelmode (PnP design in Windows) IP stack only, not some 'heavier layered on' ring 3/ rpl 3 /usermode service OR app, which, face it, ARE REDUNDANT vs. custom hosts files usage (but can/could act as 'good layered security')... apk