Slashdot Mirror

← Back to Stories (view on slashdot.org)

Researchers 'Map' Android Malware Genome

Posted by Soulskill on from the nefarious-base-pairs dept.

yahoi writes "Researchers at NC State are sharing their analysis and classification of Android malware samples under a new project that they hope will help shape a new way of fighting malware, learning from the lessons of the PC generation and its traditional anti-malware products. Xuxian Jiang, the mastermind behind the Android Malware Genome Project, says defenses against this malware today are hampered by the lack of efficient access to samples (PDF), as well as a limited understanding of the various malware families targeting the Android. The goal is to establish a better way of sharing malware samples and analysis, and developing better tools to fight it, he says."

67 comments

  1. Funny how things work out by Anonymous Coward · · Score: 5, Insightful

    Remember how Slashdot spent 10+ years mocking Windows for being a malware-laden cesspool of unremovable OEM junkware with an antivirus industry built around it? Embarrassed yet?

    1. Re:Funny how things work out by rampant+mac · · Score: 2

      " help shape a new way of fighting malware, learning from the lessons of the PC generation and its traditional anti-malware products. "

      "Remember how Slashdot spent 10+ years mocking Windows for being a malware-laden cesspool of unremovable OEM junkware with an antivirus industry built around it?"

      Yep, came here to basically say the same thing. I can't believe my phone would need a virus scanner. What's next? Android Security Essentials 2012?

      --
      I like big butts and I cannot lie.
    2. Re:Funny how things work out by Anonymous Coward · · Score: 0

      Remember how Slashdot spent 10+ years mocking Windows for being a malware-laden cesspool of unremovable OEM junkware with an antivirus industry built around it? Embarrassed yet?

      wake me up when drive-by download+installation IE-style happens on Linux. oh also wake me up when the average Android user becomes as skilled as the average GNU/Linux user.

    3. Re:Funny how things work out by __aaltlg1547 · · Score: 2

      Virus scanners like they have on Windows would destroy the platform. Phones don't have unlimited battery to throw at security.

    4. Re:Funny how things work out by __aaltlg1547 · · Score: 1, Flamebait

      Wake me up when another Linux variant runs on my phone and doesn't have the same vulnerabilities as Android.

    5. Re:Funny how things work out by Calos · · Score: 1

      And which vulnerabilities are those?

      I was under the impression that most Android malware was of the trojan variety. It doesn't exploit any vulnerabilities in Android, it exploits the users' stupidity. Things you download from the market list the permissions. If a wallpaper app wants access to your accounts, SMS, contacts, phone ID, etc., you install it at your peril.

      I'm sure there are other vulnerabilities. But as far as I'm aware they are in the minority. Could be wrong.

      --
      I vote based on politicians' actions, unless contrary to my preconceptions. Often wrong, never uncertain. #iamthe99%
    6. Re:Funny how things work out by ozmanjusri · · Score: 2

      I can't believe my phone would need a virus scanner. What's next?

      Depends how firm a grip you have on reality.

      In the first half of 2011, the lion share of malware was once again written for Windows systems.

      Only one in two hundred and fifty malware programs is not a Windows program file. The proportion of classic Windows program files (Win32) continues to drop. However, .NET programs (MSIL) compensate for this loss of 0.3% and the overall share of Windows malware programs is on the rise.

      1 Win32 1.218.138 97,8 %
      2 MSIL 21.736 1,7 %
      3 WebScripts 3.123 0,3 %
      4 Scripts 832 0,1 %
      5 Mobile 803 0,1 %
      6 Java 313 7 *ix 4 233 8 NSIS 131

      http://www.gdatasoftware.co.uk/uploads/media/G_Data_MalwareReport_H1_2011_EN.pdf

      --
      "I've got more toys than Teruhisa Kitahara."
    7. Re:Funny how things work out by __aaltlg1547 · · Score: 1

      Wy bothter to exploit anything else when you can get the user to download and install your shit?

    8. Re:Funny how things work out by Calos · · Score: 1

      Yeah, that's pretty much how it works.

      That's why I was questioning why you wanted to be [woken] up when another Linux variant runs on [your] phone and doesn't have the same vulnerabilities as Android. The two notions are incongruent. That's why I was asking about specific vulnerabilities, because I wasn't aware of it really being an issue.

      --
      I vote based on politicians' actions, unless contrary to my preconceptions. Often wrong, never uncertain. #iamthe99%
    9. Re:Funny how things work out by ozmanjusri · · Score: 4, Interesting
      When you strip the anti-malware vendor hype away, the threat's a lot smaller than most people realise.

      Some of the biggest "infections" weren't really malware at all. Kindsight Security Labs Malware Report for Q1 2012 says:

      Without Plankton/Apperhand (no longer classified as malware) included in the infection statistics, mobile device infection has actually leveled off in the first quarter of 2012. We believe that this trend in mobile device infections will not last as the target is too tempting to hackers

      http://www.kindsight.net/sites/default/files/Kindsight_Security_Labs-Q112_Malware_Report-final.pdf

      --
      "I've got more toys than Teruhisa Kitahara."
    10. Re:Funny how things work out by Anonymous Coward · · Score: 0

      Caution: Don't open that link on a Windows machine.

    11. Re:Funny how things work out by symbolset · · Score: 1

      Oh, we're not done with that one yet.

      --
      Help stamp out iliturcy.
    12. Re:Funny how things work out by Anonymous Coward · · Score: 1

      Remember how Slashdot spent 10+ years mocking Windows for being a malware-laden cesspool of unremovable OEM junkware with an antivirus industry built around it? Embarrassed yet?

      Did something change? Windows is still the cesspool of malware and virus laden applications and it's responsible for most of the world's SPAM. It's also the preferred OS of Bots. It's so full of holes they need to release patches for it every week just to keep up with all of the zero days found.

    13. Re:Funny how things work out by Deorus · · Score: 1

      Haven't been using Linux for long, have you? I've had such things happen to me in the past, they were just targeted at Windows, but that didn't stop files named like c:\playerhost.dll from ending up in my home directory, on Linux. I guess you can say that I was saved by Linux's lack of popularity on the desktop, nothing else.

      You can claim that many of those vulnerabilities are gone now that Adobe has stopped developing Flash for Linux (as well as for mobile platforms), that address spaces are randomized, that compilers have evolved to generate hardened code by default, and that x86 now supports non-executable pages within code segments, but that's not always been the case, and if you're going to judge Windows for what it was, what it did, and what it does, then at least be unbiased in your judgement.

    14. Re:Funny how things work out by RaceProUK · · Score: 1

      Remember how Slashdot spent 10+ years mocking Windows for being a malware-laden cesspool of unremovable OEM junkware with an antivirus industry built around it? Embarrassed yet?

      Did something change? Windows is still the cesspool of malware and virus laden applications and it's responsible for most of the world's SPAM. It's also the preferred OS of Bots. It's so full of holes they need to release patches for it every week just to keep up with all of the zero days found.

      All because Windows has over 90% market share.

      If OSX or Linux had the same market share, then they'd see the vast majority of malware instead.

      --
      No colour or religion ever stopped the bullet from a gun
  2. Lemme guess by Taco+Cowboy · · Score: 3, Funny

    The malware genome points to Java ?

    --
    Muchas Gracias, Señor Edward Snowden !
    1. Re:Lemme guess by binarylarry · · Score: 4, Funny

      I don't see slow in there anywhere...

      --
      Mod me down, my New Earth Global Warmingist friends!
  3. Wow, could you imagine... by freeweaver · · Score: 1

    the size of a Windows map?

    In fact, I don't think there's a super computer capable of mapping it.

    1. Re:Wow, could you imagine... by Anonymous Coward · · Score: 1

      Not only is your attempt to distract from Android malware criticism lame, it's not even accurate, as PC usage today is dwarfed by smartphones and tablets. So it would be Android's that is bigger...

    2. Re:Wow, could you imagine... by Anonymous Coward · · Score: 0

      it's not even accurate, as PC usage today is dwarfed by smartphones and tablets

      [Citation needed]

      There's a lot of new smartphones and tablets sold, but there's still almost ten times as many PCs as there are smart mobile devices, and they are still mostly Windows - at least judging by all browser share counters, just check "Mobile vs Desktop" stat at any of them.

    3. Re:Wow, could you imagine... by DarwinSurvivor · · Score: 2

      If you are going to demand a citation, your rebuttal better damn well include one! I'm not saying I dissagree, but your arrogance is definitely showing.

    4. Re:Wow, could you imagine... by causality · · Score: 1

      If you are going to demand a citation, your rebuttal better damn well include one! I'm not saying I dissagree, but your arrogance is definitely showing.

      Eh I don't know. He countered an assertion with another assertion. While he could have invested a trivial amount of effort to do much better, nonetheless they remain on equal ground.

      This is speculation, but perhaps that was the point?

      --
      It is a miracle that curiosity survives formal education. - Einstein
    5. Re:Wow, could you imagine... by ozmanjusri · · Score: 1
      Latest stats say last quarter Apple activated between 613,979 to 692,551 iOS devices per day, Android activated around 700,000/day, while Windows 7 averages out at about 650,000 licenses sold per day. All those numbers are questionable (for differing reasons), but are likely to be ballpark-close.

      Windows would have a much bigger installed base, since it's been on the market longer.

      http://techcrunch.com/2011/09/13/microsoft-sold-450-million-copies-of-windows-7/

      --
      "I've got more toys than Teruhisa Kitahara."
    6. Re:Wow, could you imagine... by similar_name · · Score: 1

      For your convenience Windows vastly out numbers other operating systems either by market share or by usage.

      Sourced from first hits (at least for me) on searches for operating system market share and operating system by usage respectively.

    7. Re:Wow, could you imagine... by symbolset · · Score: 1

      Here's an interesting article from last year: Microsoft admits that one in fourteen downloads are Windows malware.

      I would say Android is a long way from having anything like this sort of problem.

      --
      Help stamp out iliturcy.
    8. Re:Wow, could you imagine... by symbolset · · Score: 1

      Bonus link.

      --
      Help stamp out iliturcy.
    9. Re:Wow, could you imagine... by Anonymous Coward · · Score: 0

      Android is up to 850,000 and nearing a Million per day.

  4. Apple's closed system by grantspassalan · · Score: 4, Insightful

    Why is it that there is no malware for IOS? There are millions of these devices out there, so there certainly is an incentive for malware writers.

    I believe that it has something to do with the fact that only Apple approved and checked software can be installed thereon. This closed system may not appeal to many here on /., but it is certainly as close as we have gotten to a malware proof computing experience we are likely to get anytime soon. Mac users will be able to enjoy this form of security with OS X 10.8 this summer.

    --
    A sufficiently advanced simulation is indistinguishable from reality.
    1. Re:Apple's closed system by Charliemopps · · Score: 4, Interesting

      Apple is using that same control to prevent you from scanning for viruses...

      http://www.forbes.com/sites/timworstall/2012/05/22/apple-wont-let-kaspersky-develop-tools-for-ios/

    2. Re:Apple's closed system by causality · · Score: 4, Insightful

      Why is it that there is no malware for IOS? There are millions of these devices out there, so there certainly is an incentive for malware writers.

      I believe that it has something to do with the fact that only Apple approved and checked software can be installed thereon. This closed system may not appeal to many here on /., but it is certainly as close as we have gotten to a malware proof computing experience we are likely to get anytime soon. Mac users will be able to enjoy this form of security with OS X 10.8 this summer.

      Many people need to play in the approved sandbox or else they'll stumble and hurt themselves. Others know what they're doing and understand the security implications of actions they take so they don't need Big Daddy Apple watching over them (and would in fact find that restrictive/suffocating).

      If you're willing to learn and attain your own understanding you will find that much more information than you would ever need is freely available. Then you achieve independence and freedom. You can then do what you like with equipment that's truly yours. If all of that is "too hard" and you prefer to use a machine for years without ever really grasping the principles behind it, then you are likely to be controlled by somebody: either a relatively benevolent vendor or a malware author. The former wants the money you choose to give to it; the latter will take everything it can.

      There isn't a One True Way. The only real mistake is to wrongly assume you are in a given category when you are not. For Joe Sixpack users who do not enjoy discovering and learning new things, the Apple method has a lot of advantages. If its widespread use makes it harder for criminals to make a profit, that benefits the rest of us as well.

      --
      It is a miracle that curiosity survives formal education. - Einstein
    3. Re:Apple's closed system by Anonymous Coward · · Score: 2, Insightful

      There is absolute malware proof computing already: just don't install anything on your computer, disconnect it from network, in fact, just cut the power completely.

      Oh, and "there's no malware on AppStore" rather depends on your defintion of malware. Sending your contact list to a third party without questions was possible until a recent update. Just junkware and scams? Check. Just google for "pokemon yellow ios", for example.

      Yes, iOS malware can't spam SMS or hang in background, but on the other hand iOS apps can't send SMS or work in background.

      This security has quite a big tradeoff of censorship and dumbing down, so no, but thanks, no. Judging by market trends, general population seems to lean towards "free (as in freedom), but still has risks" side from "let us tell you what you want" side.

    4. Re:Apple's closed system by Anonymous Coward · · Score: 0

      jailbreak apps are malware and the same techniques used by jailbreaking malware can be used by other malware that does something the device owner considers to be "mal"

    5. Re: Apple's closed system by Anonymous Coward · · Score: 0

      unmod

    6. Re:Apple's closed system by grantspassalan · · Score: 1

      So what, if there are no viruses, why does anybody have to scan for them? The only ones being harmed by Apple's business model of this closed system, are the developers of antivirus software. In the new OS X 10.8 OS, users who desperately want to install any software whatsoever, including a virus or Trojan, can still deliberately do so.

      --
      A sufficiently advanced simulation is indistinguishable from reality.
    7. Re:Apple's closed system by Anonymous Coward · · Score: 0

      There IS malware for Apple. The difference is that Apple doesn't allow antivirus program makers to create apps, so there's no point in those antivirus makers publishing inflammatory, misleading, and mostly-untrue "studies".

    8. Re: Apple's closed system by causality · · Score: 1

      unmod

      That works better when you don't post AC.

      --
      It is a miracle that curiosity survives formal education. - Einstein
    9. Re: Apple's closed system by gmhowell · · Score: 1

      unmod

      That works better when you don't post AC.

      I haven't tested it, but I've read reports that while you do not get the warning if you post AC to a discussion in which you have posted, it will still remove said moderations.

      --
      Jesus was all right but his disciples were thick and ordinary. -John Lennon
    10. Re: Apple's closed system by causality · · Score: 1

      unmod

      That works better when you don't post AC.

      I haven't tested it, but I've read reports that while you do not get the warning if you post AC to a discussion in which you have posted, it will still remove said moderations.

      If so I believe that's a new thing.

      Also, regarding your sig... His disciples were definitely thick. They were not ordinary. They showed extraordinary courage. I mean... Peter was executed by crucifixion. His lament? He did not feel worthy to die by the same method as his Master. So according to legend, he was crucified ... upside-down. Ordinary people would have been like the "old Peter" who denied Him thrice.

      --
      It is a miracle that curiosity survives formal education. - Einstein
    11. Re:Apple's closed system by __aaltlg1547 · · Score: 2, Insightful

      The level of access that an antivirus program needs is the level of access that a virus needs. Apple's not giving that to the would-be malware creators either.

      Besides, an antivirus program for iOS makes no sense because there aren't any such things to protect against. .

    12. Re:Apple's closed system by __aaltlg1547 · · Score: 3, Insightful

      Many people need to play in the approved sandbox or else they'll stumble and hurt themselves. Others know what they're doing and understand the security implications of actions they take so they don't need Big Daddy Apple watching over them (and would in fact find that restrictive/suffocating).

      No, not many. A few. The iPhone is a consumer device. Opening it up for anybody to program and distribute whatever software they want would be of no benefit to the vast majority of users, no benefit to Apple and no benefit to the wireless providers.

      If they opened it up, they'd actually be screwing over their customers and business partners. I can't imagine a compelling argument why they should do so.

    13. Re:Apple's closed system by Anonymous Coward · · Score: 0

      Judging by market trends, general population seems to lean towards "free (as in freedom), but still has risks" side from "let us tell you what you want" side.

      That explains why iPhone users per capita buy more apps, surf the web more, view more video content than Android users right? A huge portion of Android sales are free/feature phone devices. There is no market trend towards either camp. Get over it.

    14. Re:Apple's closed system by Lussarn · · Score: 1

      I believe that it has something to do with the fact that only Apple approved and checked software can be installed thereon. This closed system may not appeal to many here on /., but it is certainly as close as we have gotten to a malware proof computing experience we are likely to get anytime soon. Mac users will be able to enjoy this form of security with OS X 10.8 this summer.

      It is obviously a security feature to have trusted sources for your programs, there is nothing new to this, Linux have used this for the last 15 years and I can't believe Linux was the first. You have to understand that Unix was created like 40 years ago, and there is nothing technically secure about it in todays world. This is the same for Linux, BSD, OSX, Android and IOS. Most security is bolted upon it but the fact is that it probably can't be totaly secured, it's not designed that way. Compare with a web browser or Java/Flash/NaCL which is secure by design. Yes, they have security holes but they can be fixed. Unix is "fixed" by having trusted sources, that's not a technical solution. The problem with Apples stance on this subject is that there source is the only source on the IOS platform, and they happen to use it for a lot more than security, like keeping the competition out. Yes, I know *nix isn't really secure, but I still want to be able to run certain programs (this is more important to me than outmost security), and I wan't to use a platform where competition is fair.

    15. Re:Apple's closed system by symbolset · · Score: 1

      Exactly. If you need Antivirus, you're doing it wrong.

      --
      Help stamp out iliturcy.
    16. Re:Apple's closed system by Anonymous Coward · · Score: 0

      "For Joe Sixpack users who do not enjoy discovering and learning new things, the Apple method has a lot of advantages."

      For Joe Sixpack users that have better things to do (and an outdoor life) than fiddle with a phone, the Apple method has a lot of advantages.

      There, fixed that for you.

    17. Re:Apple's closed system by ediron2 · · Score: 1

      Ratfucker slashcode just ate my comment.

      Came here to call you a pedant and point out that some of us like iphones because we already have too many other avenues for puttering; sometimes it's nice just to have a phone. Ok, a phone plus games and twitter and gps and media and email and.... but I'm ok that my 4s is NOT where I focus my hackerly urges. I don't have time for all the projects queued up in my home office (or as my wife calls it, that "damn mountain of electronics"). Lost my orig. comment trying to grok why slashcode was ignoring my html tags (my ul's and li's didn't yield bullets!!!) so you don't get a list this time.

      I promise, it isn't fear or wanting Apple to be my mommy...

    18. Re:Apple's closed system by tlhIngan · · Score: 1

      Why is it that there is no malware for IOS? There are millions of these devices out there, so there certainly is an incentive for malware writers.

      I believe that it has something to do with the fact that only Apple approved and checked software can be installed thereon. This closed system may not appeal to many here on /., but it is certainly as close as we have gotten to a malware proof computing experience we are likely to get anytime soon. Mac users will be able to enjoy this form of security with OS X 10.8 this summer.

      Because there's accountability in the App Store. You see, to get an app in there, you have to pay $99 a year. Which means you need a valid billing account Sure malware can use a fake credit card, but when Apple gets a chargeback, they'll cancel the account and remove the app.

      Next, if there's really a bad app in there, boom, Apple removes all the developer's apps and closes their account. And with a valid billing address means Apple can hunt you down. Hell, if you want to accept money for apps Apple makes you jump through hoops.

      It's just like the Flashback trojan - making money is easy, but getting paid is actually quite hard.

      The other reason is iOS makes it quite hard - to send a text message requires user intervention - an app can't send a text message on its own unless it uses its own service. Ditto phone calls - you can call up the dialer, but it'll ask if you really wanted to dial that number.

      The only real way to get malware onto iOS without exposing a real identity is via jailbreaks and surreptitious installation that way. To which iOS isn't immune.

      An interesting Android hack popped up recently - due to the way smartphone data plans work, an Android app with "Internet Access" can hijack any TCP connection on the phone.

    19. Re:Apple's closed system by Anonymous Coward · · Score: 0

      Watch out, you'll upset all the fanbois that are here to brag on how their walled kindergarden protects them from the freedom of the outside world!
      They are so happy spewing misinformation on the (almost non-existing) android malware and upvoting each other, they might vote you down as troll just for stating the facts!
      (Which means this comment will very likely be voted down into oblivion in the next couple of seconds)

    20. Re:Apple's closed system by Deorus · · Score: 1

      Your train of thought crashed as soon as you failed to realize the difference between research and production. It is perfectly OK to research one platform while using another, there is absolutely nothing wrong with that. I have developed the Linux kernel in the past and that hasn't stopped me from turning into an Apple fag. My understanding of how operating systems work does not make me want to tinker them all, quite the opposite. I am perfectly fine when things just work, that is my goal as an engineer.

    21. Re:Apple's closed system by causality · · Score: 1

      Your train of thought crashed as soon as you failed to realize the difference between research and production. It is perfectly OK to research one platform while using another, there is absolutely nothing wrong with that. I have developed the Linux kernel in the past and that hasn't stopped me from turning into an Apple fag. My understanding of how operating systems work does not make me want to tinker them all, quite the opposite. I am perfectly fine when things just work, that is my goal as an engineer.

      I was talking about users who *need* a managed experience or else they get into trouble. *Need*. I think people replying to me didn't get that part and perhaps I should have made it more clear.

      Wanting one or finding it convenient is different. If you can do serious kernel development then you are more skilled than I am, and I definitely don't need a managed experience. Yours is a genuine preference. It is not a need. That isn't what I was talking about at all and doesn't fit anything I was saying. I just get tired sometimes of how low the standards are, how little people expect of themselves. If the masses benefit from something, that didn't happen because of them. I'd rather it did.

      Incidentally I wouldn't call you an "Apple fag" or any other kind of "fag". The way you articulate yourself is better than that.

      --
      It is a miracle that curiosity survives formal education. - Einstein
    22. Re:Apple's closed system by Anonymous Coward · · Score: 0

      Charlie Miller's application was white hat, but it's still malware as it installed a command and control server on your phone masquerading as a stock ticker app. It passed the "review", and was published to the store. His code exploited a privilege escalation bug that he repeatedly told them about but nothing came of it.

      The only reason why his app was caught and banned was because he came out and said that he did so.

      So I challenge you: prove to me that all 500,000 applications do not have any similar code.

      Oh wait, you can't. Well, unless the malware author comes forward with a "guilty" conscience. Nobody can even scan for the exploit Charlie Miller used because it's all wrapped up tight. Out of sight, out of mind, right?

    23. Re:Apple's closed system by Anonymous Coward · · Score: 0

      re: per capita
      That's only because people on i* devices are locked into the app store and MUST pay for the "privilege" of buying from there.

      Android users who know about GetJar, have access to Amazon App Store, or even buy a Samsung Galaxy S / S II / SIII device all have secondary stores that offer company-paid content. This can total over thousands for dollars for the average user while staying legitimate (that's not counting users who can freely pirate content)

      Just because an iuser is blind to alternatives has no implications.

      P.S. You know what I find odd about the "surf the web more"? That phone has the most dedicated website replacement applications (i.e. applications that provide a native version of the website) -- why are they surfing the web?

      P.P.S. There IS a market trend towards Android exactly because what you say: they can get a relatively decent-to-good smart phone for cheap or free. A Galaxy S2 with LTE is now just $50 on a 3 year contract. If you're not into high end games, that's good enough CPU/GPU/resolution with a massive screen.

    24. Re:Apple's closed system by Anonymous Coward · · Score: 0

      Because there's accountability in the Play Store. You see, to get an app in there, you have to pay $15 one time. Which means you need a valid billing account Sure malware can use a fake credit card, but when Google gets a chargeback, they'll cancel the account and remove the app.

      Next, if there's really a bad app in there, boom, Google removes all the developer's apps and closes their account. And with a valid billing address means Google can hunt you down. Hell, if you want to accept money for apps Google makes you jump through hoops.

      It's just like the Flashback trojan - making money is easy, but getting paid is actually quite hard.

      The other reason is Android makes it quite hard - to send a text message requires user intervention - an app can't send a text message on its own unless it specifically tells you "SERVICES THAT COST YOU MONEY; SEND SMS". Ditto phone calls - you can call up the dialer, but it'll ask if you really wanted to dial that number or it specifically tells you "SERVICES THAT COST YOU MONEY; PHONE CALLS".

      The only real way to get malware onto Android without exposing a real identity is via jailbreaks and a checkbox that WARNS the user that their safety is in their own hands. To which Android isn't immune.

      An interesting i OS hack popped up recently - due to the way smartphone data plans work, an i OS app with "Internet Access" can hijack any TCP connection [arstechnica.com] on the phone. [read the article: "... will also work against computers connected to networks using cellular cards or smartphone tethers. He said there's no reason to believe i OS devices ... can't be hijacked as well." Incidentally, if I wanted to protect myself on Android, all I have to do is go through my applications and remove or not run any that have the Internet permission. Can you guarantee that any applications on any other platform (i* included) do NOT use internet? No, I didn't think so.

      P.S. You see what I did there?

  5. I'm willing to bet by InspectorGadget1964 · · Score: 1

    It comes from One Microsoft way in Redmond?

  6. Not a new concept by Shoten · · Score: 1

    DARPA has a project going on this right now...it's called the "Cyber Genome" project. The idea is that you can perform a fair bit of attribution to the person/organization that wrote a piece of malware based on the characteristics of the code. It's true, as well...examination of Stuxnet, for example, made it clear that it was probably written by a highly organized team of diverse and very skilled individuals. And that's just looking at a single piece of malware; looking at things like Zeus has shown the progression of it, and even how malware can fork and develop along different lines. If you take it to the next step, the goal is to be able to predict the characteristics of an iteration before it's even written. Yeah, nobody said DARPA tries to solve easy problems :)

    --

    For your security, this post has been encrypted with ROT-13, twice.
  7. Re:Trans Europe Express by Anonymous Coward · · Score: 0

    Who says I'm reading?

  8. I know this is nitpicking, but.... by Johann+Lau · · Score: 2

    Notice how one makes sense, the other doesn't:

    Researchers Map Android Malware 'Genome'

    Researchers 'Map' Android Malware Genome

    1. Re:I know this is nitpicking, but.... by Anonymous Coward · · Score: 0

      'Researchers' 'Map' Android Malware 'Genome'
      FTFY

    2. Re:I know this is nitpicking, but.... by Johann+Lau · · Score: 1

      Oh, you mean you "fixed" that for "me"? Why "thank you" :)

  9. myCollege Project :) by dgharmon · · Score: 1

    How to get Android and Malware in the same article.

    --
    AccountKiller
  10. I was saved by Linux's lack of popularity? by dgharmon · · Score: 1

    "didn't stop files named like c:\playerhost.dll from ending up in my home directory, on Linux. I guess you can say that I was saved by Linux's lack of popularity on the desktop, nothing else".

    No, you couldn't say that, how playerhost.dll got onto your home directory was you saved it there. And even if it was a Linux executable you would still have to perform a numbr of steps to get it to run, as well as supply the root password.

    "You can claim that many of those vulnerabilities are gone now that Adobe has stopped developing Flash for Linux"

    That's news to me, ..

    'Download Adobe Flash Player
    Adobe Flash Player version 11.2.202.235
    Your system: Linux 32-bit, Firefox    ` link

    --
    AccountKiller
    1. Re:I was saved by Linux's lack of popularity? by Anonymous Coward · · Score: 0

      IANASR, but for a start, just like with any other OS you don't need root password for many useful (from malware author viewpoint) things, like keylogging, uploading your personal data or spamming. Unless most linuxes started hardening acess restrictions usnig SELinux and whatnot, like forbidding network access for non user approved applications, it still works great. Root access is mostly needed for hiding the malware from detection, with added benefit of ability to spy on every user on multiuser system. Latter part is not really important for usual targets of malware, home users.

      My guess is getting it to run wouldn't be really a problem for dedicated attacker, something like planting .xprofile along with your executable would do the trick.

      So, given possibility of drive-by download, only things stopping dedicated Linux malware is unprofitability of targeting home Linux users. It would probably be noticed and stomped out faster as well, given higher average tech smarts of Linux users.

      Oh, and "Adobe has stopped developing Flash for Linux" probably referred to this (tl;dr: new major Flash versions will be PPAPI only, bundled with Chrome, older versions are getting security updates for 5 years)

    2. Re:I was saved by Linux's lack of popularity? by Deorus · · Score: 1

      No, you couldn't say that, how playerhost.dll got onto your home directory was you saved it there. And even if it was a Linux executable you would still have to perform a numbr of steps to get it to run, as well as supply the root password.

      No, I did not save it there, notice the name "c:\playerhost.dll", it was clearly saved by an exploit to the browser or a plugin running on it (most likely Flash). Also, where the hell does your idea that root is needed in order to run executables come from?

      Regarding Flash losing support on Linux, I may have been misconceived as I might have gotten it confused with Adobe AIR.

  11. And which vulnerabilities are those? by Anonymous Coward · · Score: 0

    "I was under the impression that most Android malware was of the trojan variety"

    Microsoft Researcher produces a report on 'Android` malware, well who would have thought?

  12. Amen: Hahaha to FUD spreading "/. 'Penguins'" by Anonymous Coward · · Score: 0

    How's it feel knowing that ur YEARS of "FUD" b.s. is crumbling around ur ears, boys?

    Question: What's it LIKE being known as a pack of utter bullshit artists online now, & especially after a DECADE OF SOLID CRAP along the lines of "Windows != Secure & Linux = Secure" horseshit... hmmm??

    I knew the day would come when Linux (or variants like ANDROID) would take "top spot" on SOME computing platform (in this case, smartphones) & get "NUKED" as badly as Windows does due to its MASSIVE DOMINANCE of the combined PC & Server world... well, that's day's here on ANDROID (a linux) on smartphones).

    It's simply because malware makers in general are JUST LIKE PICKPOCKETS, & go where the "easy meat victims" are, which IS where "the masses" go. They get better "ROI" for their creation of their bogus machinations that way... just like shooting ducks in a pack in the sky.

    Of course, I have to "toss this in" also for "good measure" as well from 2011-2012 (which ALWAYS gets "downmodded", facts in it OR NOT):

    2012:

    Medicaid hack update: 500,000 records and 280,000 SSNs stolen:

    http://www.zdnet.com/blog/security/medicaid-hack-update-500000-records-and-280000-ssns-stolen/11444

    So, what's dts.utah.gov running everyone?

    LINUX (and yes, it got HACKED) -> http://uptime.netcraft.com/up/graph?site=dts.utah.gov

    What's health.utah.gov running too??

    YOU GUESSED IT: LINUX AGAIN -> http://uptime.netcraft.com/up/graph?site=health.utah.gov

    * Ah, yes - see the YEARS OF /. "BS" FUD is CRUMBLING AROUND THE PENGUINS EARS HERE & 2012's starting out just like 2011 did below!

    ===

    2011:

    KERNEL.ORG COMPROMISED - The Cracking of Kernel.org: (that's VERY bad - do you trust it now?)

    http://linux.slashdot.org/story/11/08/31/2321232/Kernelorg-Compromised

    ---

    Linux.com pwned in fresh round of cyber break-ins:

    http://www.theregister.co.uk/2011/09/12/more_linux_sites_down/

    ---

    Mysql.com Hacked, Made To Serve Malware:

    http://it.slashdot.org/story/11/09/26/2218238/mysqlcom-hacked-made-to-serve-malware

    What's that site running? You guessed it - Linux -> http://uptime.netcraft.com/up/graph?site=mysql.com

    ---

    London Stock Exchange serving malware:

    http://slashdot.org/submission/1484548/London-Stock-Exchange-Web-Site-Serving-Malware

    (I mean hey - NOT ONLY DID LINUX FALL FLAT ON ITS FACE less than a few minutes into the job http://linux.slashdot.org/story/11/02/19/0147232/London-Stock-Exchange-Price-Errors-Emerged-At-Linux-Launch, & crash not only ONCE, but TWICE there? You see "Linux 'fine security'" in motion @ the LSE too!)

    ---

    DUQU ROOTKIT/BOTNET BEING SERVED FROM LINUX SERVERS:

    http://it.slashdot.org/story/11/11/30/1610228/duqu-attackers-managed-to-wipe-cc-servers

    ---

    Linux Foundation, Linux.com Sites Down To Fix Security Breach:

    http://linux.s