Slashdot Mirror
Mobile Ads May Serve As a Malware Conduit
alphadogg writes with this excerpt from Network World: "Many mobile apps include ads that can threaten users' privacy and network security, according to North Carolina State University researchers. The National Science Foundation-funded researchers studied 100,000 apps in Google Play (formerly Android Market) and found that more than half contained ad libraries, nearly 300 of which were enabled to grab code from remote servers that could give malware and hackers a way into your smartphone or tablet. 'Running code downloaded from the Internet is problematic because the code could be anything,' says Xuxian Jiang, an assistant professor of computer science at NC State."
Please buy our products!
:. Ultimate Control Dedicated/VM Servers
on an android system level?
etc/hosts, or dns blacklists?
He tried to kill me with a forklift!
Don't like it? Don't use it.
So far so good with this app called "adfree". Which was free. Any /. opinions on which blockers work better? Do I already have the best? /etc/hosts file, so at the ip addrs level its blocking entire hostnames.
All its doing (so far as I know) is the 1990s desktop era technique of putting certain hostnames in the
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Isn't there a way to sandbox the process running the ads?
I suspect the "ad block effect" that I'm used to from years of firefox will exist on android very soon. "(shock amazement) Thats what the unfiltered internet looks like now? how can anyone use that? (insert more shock amazement)"
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
I really didn't want to root my Gnex and lose all my settings and such, but it looks like I may have to anyways. Wonderful.
Wasn't it the case just several years ago that "adware" and "malware" were considered to be mostly synonyms? I don't see why, just because the plarform changed, they would behave any differently. You're back to the Bonzi Buddy "goodness".
I just stay away from any "App Stores" and "Foo Markets". A Debian chroot (when there are no native builds) means the code I run can be trusted.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Got root?
An iptables front-end on Android. Droid Wall is sweet: https://play.google.com/store/apps/details?id=com.googlecode.droidwall.free
As each android app runs as a separate uid, it makes it easy to block net access app-by-app. The problem, of course, is when the app you don't really trust needs net access for a real reason. Sometimes you can allow net access, let the app do it's thing, then revoke it so it's not background connecting all the time.
Also the ability to set some apps wifi-only and others 3G-only is pretty handy. This saves hours of battery life.
that's the real solution. It was only a matter of time... this type of exploit (and others to come no doubt) are the strongest argument for blocking ads.
If you want people to buy your app, create a good app and provide a malware/adware/shareware free/lite version of it. If it is a good app then people will buy it. You piss people off before they have a real chance to test your app then you stand to lose that customer. Those that do not buy your app after trying it would not buy it under any circumstance. I will continue to block apps as long as I have a means to do so. And, I will continue to buy apps from those DEV's that actually create good apps and provide them without the hassle of dealing with the garbage on the side.
Or spend the $1 on the non-free version.
The publishers of these apps aren't trying to hit you with malware, they're just trying to make a few pennies and give you something you want.
Mobile ads are just like traditional website ads? A massive infection vector?
Poorly secured servers that touch millions of individual hosts across millions of different sites, by design?
Scummy ad vendors that don't care that they're linking to dropper sites?
Yeah, not suprised. You can't trust ad vendors at all.
Ad-Aware and other ad blockers are really security products. Blocking ads is just a pleasant side effect.
We're beginning to see the cracks in the Android dam
I don't think there ever was a dam- I've been able to install anything I want on my Android as long as I've had it. People will exploit devices and services whether it is Android, Windows, Mac,or Linux. That's life, and it's the risk we take to have the freedom to do what we want on our devices. Freedom isn't free, right?
For years I've been telling fellow mobile developers that in exchange for ad revenue - or even for usage statistics - they're giving up AT MINIMUM the privacy of their users -- something which isn't theirs to give up in the first place. As ad libraries grow more complex, it's certainly no surprise to learn that there's more than privacy at stake.
When you incorporate libraries that give up part of your control over your application, you can also be certain that you're giving up your users' control over their device.
I can only speak for Android, since I don't own an iDevice, but the market is so saturated with ad-driven apps that it reminds me of windows some years ago, where everything was adware or shareware.
Being from a Linux world where you get pretty much free (in both meanings) access to tools and programs, check/edit the source and other things, Android feels like a wild jungle, so closed and just feels like it's kind of hostile to the user, somehow.
Besides, you are getting ad-based versions of paid apps as "FREE" most of the time. So you are paying with ad revenue and purchases. I bet there are paid apps with ads as well.
One problem with ad libraries, which are served up via Google, Apple [emphasis mine] or other such companies, is that app users essentially give them the same access permissions as the apps themselves, allowing them to skirt standard security processes.
This is still a threat on iOS - ads don't just come in free apps, the browser can load them on websites too. Detecting and serving specific ads to specific hardware is trivial.
This isn't pure altruism but simply because I don't want my app tainted by scummy annoying ads or malware. I get a lot of spam from alternative ad providers with a hook such as I can earn 10x as much money by using their service. But a cursory glance at their marketing blurb leads me to conclude that their business is usually derived from enticing users to take surveys, 30 day trials and run other apps and all with far broader permissions such as read/write from SD, GPS location and so on. One advertiser worryingly also says they install "ad icons" on the user's phone meaning that my app would have to have ask for a pile of permissions just to enable this crap and it wouldn't be for the user's benefit.
So as a responsible developer I stick with AdMob. But I can see how the danger is there. My advice for end users is only install apps which ask for a minimal set of permissions and uninstall apps which start serving annoying or dodgy content. Perhaps it won't stop attacks occurring but at least it means they won't be occurring for people exercising some restraint and common sense.
Take a look at the author's blog on Networkworld (click on his alphadogg tag in the byline). Mostly "i"thing announcements. Gee, I wonder if his "research" is skewed.
He's really confusing 3 things in the article:
1) Ads have the same permissions as the app itself. However, HTML has no provisions to access the filesystem automatically. It would only have access to your GPS should the originating app also have permission.
2) Downloading code? Downloading HTML is practically harmless to the running state of the OS; it might damage your privacy a bit, but that's it.
2.5) Is it talking about apps that try to get you to install more programs? On Android, you're still greeted with a permission screen at least.
Again, all 3 of these could apply to ALL Operating systems, but for some reason has a heavy Android slant. I mean seriously, "to grab code from remote servers that ***could*** give malware and hackers a way into your smartphone or tablet."? They reviewed 300 ad networks and found that it "could"? I could catch all sorts of diseases by sitting on a public toilet, do you see anyone getting cancer/AIDs/STDs?
I immediately thought of Saren saying "One step closer to finding the conduit." Been playing too much Mass Effect :)
You're so clever you must cut yourself on a regular basis.
Check your premises.
The vast majority of posts I see point out the obviousness of rooting your phone and running any of a number ad-blockers and how great they are. That's no different than someone responding to a regular Joe's desktop Linux complaint with a "Duh, change your config, rebuild your kernel and move on....". You've just lost the average person who might otherwise be interested in playing. The VAST majority of Android users have absolutely no ability or interest in having to "root" their phone, finding a good ad-blocker, and then install it. There are millions of people having a less-than-steller experience, probably not even realizing what's going on and the best answer from the tech community isn't "Let's fix the process", or even "Let's exhort Google to fix the process", but rather an almost patronizing rolling of the eyes and an explanation of how "easy" it is to fix.
1) Require that anything in the android market have its source uploaded to a Google repository.
Goodbye Angry Birds, and EA...
Have all apps compiled by Google.
As a developer I am greatly dismayed by the idea that I may have to fix bugs introduced by Google messing up compiler settings.
Give the ad library a "master switch" to turn off ads in an app, in exchange for an amount of money commensurate with the proceeds from ads. Therefore all ad-based apps can become no-ad apps in a uniform way.
That's not a bad idea, but the ad company builds the library so how will they get money from the action that kills off the only revenue stream they have?
Make the ad library a separate app (ad server) with its own permissions so that the app,
I'm not sure you understand how many different ad libraries there are, you seem to think of this as there being just one.
Make all paid apps "try-before-you-buy" with a reasonable time to evaluate, like a few days.
If only Apple and Google would BOTH do that. It is in the power of the system to de-atuth after some time....
Finally, addressing TFA, return to the text-based ads that made Google famous, and get rid of the current invasive android advertising.
Too late for that I'm afraid.
Requiring open source will seriously discourage malware
I am very doubtful that would be the case. Lots of malware is just copied from elsewhere. They don't care if people find out after a bit, by then they have what they wanted from a lot of users.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I am sure nobody will remember this post while they accuse you of being an Apple shill/fanboi.
Jesus was all right but his disciples were thick and ordinary. -John Lennon
now what do you do when you run into the app that checks to see if it's ad network is in your hosts file(mind you only looks to see that it is there, not that it is set to something non-nonsensical)?
All of the above was encrypted with a Quad ROT-13 method. Unauthorized decryption is in violation of the DMCA.